diff --git a/templates/external-secret.yaml b/templates/external-secret.yaml
index f4e43d3..9189478 100644
--- a/templates/external-secret.yaml
+++ b/templates/external-secret.yaml
@@ -17,5 +17,5 @@ spec:
     name: {{ .Values.secrets.secretName | default (printf "%s-secret" (include "typesense.fullname" .)) }}
   dataFrom:
     - extract:
-        key: {{ .Values.secrets.externalSecret.extractKey }}
+        key: {{ required "secrets.externalSecret.extractKey is required when secrets.externalSecret.enabled is true" .Values.secrets.externalSecret.extractKey | quote }}
 {{- end }}
diff --git a/tests/external_secret_test.yaml b/tests/external_secret_test.yaml
index 58eed3f..57a9ef6 100644
--- a/tests/external_secret_test.yaml
+++ b/tests/external_secret_test.yaml
@@ -37,6 +37,16 @@ tests:
       - equal:
           path: .spec.secretStoreRef.name
           value: my-secret-store
+  - it: should fail when extractKey is empty
+    set:
+      secrets:
+        externalSecret:
+          enabled: true
+          storeName: my-secret-store
+          extractKey: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: secrets.externalSecret.extractKey is required when secrets.externalSecret.enabled is true
   - it: should not render ExternalSecret when disabled
     set:
       secrets: