diff --git a/apps/forge/forgejo-kustomization.yaml b/apps/forge/forgejo-kustomization.yaml
index 9b56c69..b7b1216 100644
--- a/apps/forge/forgejo-kustomization.yaml
+++ b/apps/forge/forgejo-kustomization.yaml
@@ -21,10 +21,10 @@ spec:
     - name: single-sign-on
   postBuild:
     substituteFrom:
-      - kind: Secret
-        name: stackspin-cluster-variables
       - kind: ConfigMap
         name: stackspin-forgejo-kustomization-variables
+      - kind: Secret
+        name: stackspin-cluster-variables
       - kind: Secret
         name: stackspin-forgejo-variables
       # OIDC
diff --git a/apps/forge/forgejo-secrets-kustomization.yaml b/apps/forge/forgejo-secrets-kustomization.yaml
index 2c0e363..301291e 100644
--- a/apps/forge/forgejo-secrets-kustomization.yaml
+++ b/apps/forge/forgejo-secrets-kustomization.yaml
@@ -16,3 +16,7 @@ spec:
   dependsOn:
     - name: flux
     - name: secrets-controller
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: stackspin-cluster-variables
diff --git a/apps/ninja/invoiceninja-kustomization.yaml b/apps/ninja/invoiceninja-kustomization.yaml
index 42694b5..adf4475 100644
--- a/apps/ninja/invoiceninja-kustomization.yaml
+++ b/apps/ninja/invoiceninja-kustomization.yaml
@@ -21,12 +21,12 @@ spec:
     #- name: single-sign-on
   postBuild:
     substituteFrom:
+      - kind: ConfigMap
+        name: stackspin-invoiceninja-kustomization-variables
       - kind: Secret
         name: stackspin-cluster-variables
       - kind: Secret
         name: stackspin-invoiceninja-variables
-      - kind: ConfigMap
-        name: stackspin-invoiceninja-kustomization-variables
       - kind: Secret
         name: stackspin-invoiceninja-oauth-variables
         optional: true
diff --git a/apps/ninja/invoiceninja/invoiceninja-values-configmap.yaml b/apps/ninja/invoiceninja/invoiceninja-values-configmap.yaml
index 3235c17..f911c66 100644
--- a/apps/ninja/invoiceninja/invoiceninja-values-configmap.yaml
+++ b/apps/ninja/invoiceninja/invoiceninja-values-configmap.yaml
@@ -76,4 +76,4 @@ data:
     #    - name: Stackspin
     #      key: "${client_id}"
     #      secret: "${client_secret}"
-    #      autoDiscoverUrl: 'https://sso.${domain}/.well-known/openid-configuration'
+    #      autoDiscoverUrl: 'https://${hydra_domain}/.well-known/openid-configuration'