diff --git a/core/installer/values-tmpl/headscale.cue b/core/installer/values-tmpl/headscale.cue
index e3453ba..1db5eb8 100644
--- a/core/installer/values-tmpl/headscale.cue
+++ b/core/installer/values-tmpl/headscale.cue
@@ -22,6 +22,14 @@
 }
 
 charts: {
+	oauth2Client: {
+		chart: "charts/oauth2-client"
+		sourceRef: {
+			kind: "GitRepository"
+			name: "pcloud"
+			namespace: global.id
+		}
+	}
 	headscale: {
 		chart: "charts/headscale"
 		sourceRef: {
@@ -32,7 +40,27 @@
 	}
 }
 
+_domain: "\(input.subdomain).\(global.domain)"
+_oauth2ClientSecretName: "oauth2-client"
+
 helm: {
+	"oauth2-client": {
+		chart: charts.oauth2Client
+		// TODO(gio): remove once hydra maester is installed as part of dodo itself
+		dependsOnExternal: [{
+			name: "auth"
+			namespace: "\(global.namespacePrefix)core-auth"
+		}]
+		values: {
+			name: "oauth2-client"
+			secretName: _oauth2ClientSecretName
+			grantTypes: ["authorization_code"]
+			responseTypes: ["code"]
+			scope: "openid profile email"
+			redirectUris: ["https://\(_domain)/oidc/callback"]
+			hydraAdmin: "http://hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
+		}
+	}
 	headscale: {
 		chart: charts.headscale
 		dependsOnExternal: [{
@@ -48,15 +76,13 @@
 			storage: size: "5Gi"
 			ingressClassName: _ingressPublic
 			certificateIssuer: _issuerPublic
-			domain: "\(input.subdomain).\(global.domain)"
+			domain: _domain
 			publicBaseDomain: global.domain
-			oauth2: {
-				hydraAdmin: "http://hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
-				hydraPublic: "https://hydra.\(global.domain)"
-				clientId: "headscale"
-				secretName: "oauth2-client-headscale"
-			}
 			ipAddressPool: "\(global.id)-headscale"
+			oauth2: {
+				secretName: _oauth2ClientSecretName
+				issuer: "https://hydra.\(global.domain)"
+			}
 			api: {
 				port: 8585
 				ipSubnet: input.ipSubnet
diff --git a/core/installer/values-tmpl/matrix.cue b/core/installer/values-tmpl/matrix.cue
index f516244..9daf2eb 100644
--- a/core/installer/values-tmpl/matrix.cue
+++ b/core/installer/values-tmpl/matrix.cue
@@ -15,7 +15,7 @@
 	matrix: {
 		repository: "matrixdotorg"
 		name: "synapse"
-		tag: "latest"
+		tag: "v1.98.0"
 		pullPolicy: "IfNotPresent"
 	}
 	postgres: {
@@ -27,6 +27,14 @@
 }
 
 charts: {
+	oauth2Client: {
+		chart: "charts/oauth2-client"
+		sourceRef: {
+			kind: "GitRepository"
+			name: "pcloud"
+			namespace: global.id
+		}
+	}
 	matrix: {
 		chart: "charts/matrix"
 		sourceRef: {
@@ -45,7 +53,21 @@
 	}
 }
 
+_oauth2ClientSecretName: "oauth2-client"
+
 helm: {
+	"oauth2-client": {
+		chart: charts.oauth2Client
+		values: {
+			name: "oauth2-client"
+			secretName: _oauth2ClientSecretName
+			grantTypes: ["authorization_code"]
+			responseTypes: ["code"]
+			scope: "openid profile"
+			redirectUris: ["https://\(_domain)/_synapse/client/oidc/callback"]
+			hydraAdmin: "http://hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
+		}
+	}
 	matrix: {
 		dependsOn: [
 			postgres
@@ -55,9 +77,8 @@
 			domain: global.domain
 			subdomain: input.subdomain
 			oauth2: {
-				hydraAdmin: "http://hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
-				hydraPublic: "https://hydra.\(global.domain)"
 				secretName: "oauth2-client"
+				issuer: "https://hydra.\(global.domain)"
 			}
 			postgresql: {
 				host: "postgres"
diff --git a/core/installer/values-tmpl/pihole.cue b/core/installer/values-tmpl/pihole.cue
index c9cc61d..a1ec66a 100644
--- a/core/installer/values-tmpl/pihole.cue
+++ b/core/installer/values-tmpl/pihole.cue
@@ -21,6 +21,14 @@
 }
 
 charts: {
+	oauth2Client: {
+		chart: "charts/oauth2-client"
+		sourceRef: {
+			kind: "GitRepository"
+			name: "pcloud"
+			namespace: global.id
+		}
+	}
 	pihole: {
 		chart: "charts/pihole"
 		sourceRef: {
@@ -31,7 +39,21 @@
 	}
 }
 
+_oauth2ClientSecretName: "oauth2-client"
+
 helm: {
+	"oauth2-client": {
+		chart: charts.oauth2Client
+		values: {
+			name: "oauth2-client"
+			secretName: _oauth2ClientSecretName
+			grantTypes: ["authorization_code"]
+			responseTypes: ["code"]
+			scope: "openid profile email"
+			redirectUris: ["https://\(_domain)/oauth2/callback"]
+			hydraAdmin: "http://hydra-admin.\(global.namespacePrefix)core-auth.svc.cluster.local"
+		}
+	}
 	pihole: {
 		chart: charts.pihole
 		values: {
@@ -81,11 +103,11 @@
 				}
 			}
 			oauth2: {
-				secretName: "oauth2-secret"
-				configName: "oauth2-proxy"
-				hydraAdmin: "http://hydra-admin.\(global.namespacePrefix)core-auth.svc"
+				cookieSecret: "1234123443214321"
+				secretName: _oauth2ClientSecretName
+				issuer: "https://hydra.\(global.domain)"
 			}
-			hydraPublic: "https://hydra.\(global.domain)"
+			configName: "oauth2-proxy"
 			profileUrl: "https://accounts-ui.\(global.domain)"
 			ingressClassName: input.network.ingressClass
 			certificateIssuer: input.network.certificateIssuer