diff --git a/core/installer/values-tmpl/dodo-app.cue b/core/installer/values-tmpl/dodo-app.cue
index fe7e504..349f0d6 100644
--- a/core/installer/values-tmpl/dodo-app.cue
+++ b/core/installer/values-tmpl/dodo-app.cue
@@ -52,15 +52,6 @@
 _domain: "\(input.subdomain).\(input.network.domain)"
 url: "https://\(_domain)"
 
-portForward: [#PortForward & {
-	allocator: input.network.allocatePortAddr
-	reservator: input.network.reservePortAddr
-	deallocator: input.network.deallocatePortAddr
-	sourcePort: input.sshPort
-	serviceName: "soft-serve"
-	targetPort: 22
-}]
-
 out: {
 	images: {
 		softserve: {
@@ -121,6 +112,15 @@
 		}
 	}
 
+	openPort: [{
+		network: input.network
+		port: input.sshPort
+		service: {
+			name: "soft-serve"
+			port: 22
+		}
+	}]
+
 	helm: {
 		softserve: {
 			chart: charts.softserve
diff --git a/core/installer/values-tmpl/gerrit.cue b/core/installer/values-tmpl/gerrit.cue
index 6d232f7..2c57ed5 100644
--- a/core/installer/values-tmpl/gerrit.cue
+++ b/core/installer/values-tmpl/gerrit.cue
@@ -45,6 +45,15 @@
 		}
 	}
 
+	openPort: [{
+		network: input.network
+		port: input.sshPort
+		service: {
+			name: "gerrit-gerrit-service"
+			port: _sshPort
+		}
+	}]
+
 	// TODO(gio): configure busybox
 	images: {
 		gerrit: {
@@ -315,14 +324,5 @@
 _httpPort: 80
 _sshPort: 22
 
-portForward: [#PortForward & {
-	allocator: input.network.allocatePortAddr
-	reservator: input.network.reservePortAddr
-	deallocator: input.network.deallocatePortAddr
-	sourcePort: input.sshPort
-	serviceName: "gerrit-gerrit-service"
-	targetPort: _sshPort
-}]
-
 _oauth2ClientCredentials: "gerrit-oauth2-credentials"
 _gerritConfigMapName: "gerrit-config"
diff --git a/core/installer/values-tmpl/soft-serve.cue b/core/installer/values-tmpl/soft-serve.cue
index a6f85c0..dae0515 100644
--- a/core/installer/values-tmpl/soft-serve.cue
+++ b/core/installer/values-tmpl/soft-serve.cue
@@ -36,15 +36,6 @@
   </g>
 </svg>"""
 
-portForward: [#PortForward & {
-	allocator: input.network.allocatePortAddr
-	reservator: input.network.reservePortAddr
-	deallocator: input.network.deallocatePortAddr
-	sourcePort: input.sshPort
-	serviceName: "soft-serve"
-	targetPort: 22
-}]
-
 
 out: {
 	images: {
@@ -77,6 +68,15 @@
 		}
 	}
 
+	openPort: [{
+		network: input.network
+		port: input.sshPort
+		service: {
+			name: "soft-serve"
+			port: 22
+		}
+	}]
+
 	volumes: data: size: "1Gi"
 
 	helm: {