diff --git a/stormforge-agent/components/stormforge-agent/application.yaml b/stormforge-agent/components/stormforge-agent/application.yaml
index 0526a1d..c5f5228 100644
--- a/stormforge-agent/components/stormforge-agent/application.yaml
+++ b/stormforge-agent/components/stormforge-agent/application.yaml
@@ -6,14 +6,16 @@ metadata:
   namespace: argocd
   finalizers:
     - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: '3'
 spec:
   destination:
     namespace: stormforge-system
     name: <CLUSTER_DESTINATION>
   project: <PROJECT>
   source:
-    chart: stormforge
-    repoURL: oci://registry.stormforge.io/library/stormforge-agent
+    chart: stormforge-agent
+    repoURL: registry.stormforge.io/library
     targetRevision: 2.10.8
     helm:
       releaseName: stormforge
@@ -21,7 +23,7 @@ spec:
         clusterName: <CLUSTER_NAME>
         stormforge:
           address: https://api.stormforge.io/
-          manageAuthSecret: false
+        manageAuthSecret: false
   syncPolicy:
     automated:
       prune: true
diff --git a/stormforge-agent/components/stormforge-agent/external-secret.yaml b/stormforge-agent/components/stormforge-agent/external-secret.yaml
index 004cc22..befb677 100644
--- a/stormforge-agent/components/stormforge-agent/external-secret.yaml
+++ b/stormforge-agent/components/stormforge-agent/external-secret.yaml
@@ -4,6 +4,8 @@ kind: ExternalSecret
 metadata:
   name: stormforge-agent-secret
   namespace: stormforge-system
+  annotations:
+    argocd.argoproj.io/sync-wave: '2'
 spec:
   target:
     name: stormforge-agent-auth
diff --git a/stormforge-agent/components/stormforge-agent/oci-registry-stormforge-argocd-secret.yaml b/stormforge-agent/components/stormforge-agent/oci-registry-stormforge-argocd-secret.yaml
new file mode 100644
index 0000000..409d09f
--- /dev/null
+++ b/stormforge-agent/components/stormforge-agent/oci-registry-stormforge-argocd-secret.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Secret #secrets don't typically belong in gitops. there are no sensitive values here.
+metadata:
+  name: stormforge-agent
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: '1'
+type: Opaque
+data:
+  enableOCI: dHJ1ZQ==
+  name: c3Rvcm1mb3JnZS1hZ2VudA==
+  type: aGVsbQ==
+  url: b2NpOi8vcmVnaXN0cnkuc3Rvcm1mb3JnZS5pby9saWJyYXJ5L3N0b3JtZm9yZ2UtYWdlbnQ=