diff --git a/core/installer/app.go b/core/installer/app.go
index fa2e270..ac83a66 100644
--- a/core/installer/app.go
+++ b/core/installer/app.go
@@ -55,6 +55,7 @@
 	"values-tmpl/private-network.cue",
 	"values-tmpl/resource-renderer-controller.cue",
 	"values-tmpl/welcome.cue",
+	"values-tmpl/hydra-maester.cue",
 }
 
 const cueBaseConfigImports = `
diff --git a/core/installer/bootstrapper.go b/core/installer/bootstrapper.go
index c5de23d..e496709 100644
--- a/core/installer/bootstrapper.go
+++ b/core/installer/bootstrapper.go
@@ -97,6 +97,10 @@
 	if err := b.installEnvManager(ss, repoIO, nsGen, b.ns, env); err != nil {
 		return err
 	}
+	fmt.Println("Installing Ory Hydra Maester")
+	if err := b.installOryHydraMaester(ss, repoIO, nsGen, b.ns, env); err != nil {
+		return err
+	}
 	fmt.Println("Environment ready to use")
 	return nil
 }
@@ -521,6 +525,36 @@
 	return repo.InstallApp(app, filepath.Join("/infrastructure", app.Name()), derived.Values, derived)
 }
 
+func (b Bootstrapper) installOryHydraMaester(ss *soft.Client, repo RepoIO, nsGen NamespaceGenerator, nsCreator NamespaceCreator, env EnvConfig) error {
+	appRepo := NewInMemoryAppRepository(CreateAllApps())
+	app, err := appRepo.Find("hydra-maester")
+	if err != nil {
+		return err
+	}
+	namespaces := make([]string, len(app.Namespaces()))
+	for i, n := range app.Namespaces() {
+		namespaces[i], err = nsGen.Generate(n)
+		if err != nil {
+			return err
+		}
+	}
+	for _, n := range namespaces {
+		if err := nsCreator.Create(n); err != nil {
+			return err
+		}
+	}
+	derived := Derived{
+		Global: Values{
+			PCloudEnvName: env.Name,
+		},
+		Values: map[string]any{},
+	}
+	if len(namespaces) > 0 {
+		derived.Release.Namespace = namespaces[0]
+	}
+	return repo.InstallApp(app, filepath.Join("/infrastructure", app.Name()), derived.Values, derived)
+}
+
 func (b Bootstrapper) installDNSZoneManager(ss *soft.Client, repo RepoIO, nsGen NamespaceGenerator, nsCreator NamespaceCreator, env EnvConfig) error {
 	const (
 		volumeClaimName = "dns-zone-configs"
diff --git a/core/installer/values-tmpl/core-auth.cue b/core/installer/values-tmpl/core-auth.cue
index 0d99ffd..99840ab 100644
--- a/core/installer/values-tmpl/core-auth.cue
+++ b/core/installer/values-tmpl/core-auth.cue
@@ -48,12 +48,6 @@
 		tag: "v2.2.0-distroless"
 		pullPolicy: "IfNotPresent"
 	}
-	"hydra-maester": {
-		repository: "giolekva"
-		name: "ory-hydra-maester"
-		tag: "latest"
-		pullPolicy: "Always"
-	}
 	ui: {
 		repository: "giolekva"
 		name: "auth-ui"
@@ -378,18 +372,7 @@
 					enabled: true
 				}
 				maester: {
-					enabled: true
-				}
-				"hydra-maester": {
-					adminService: {
-						name: "hydra-admin"
-						port: 80
-					}
-					image: {
-						repository: images["hydra-maester"].fullName
-						tag: images["hydra-maester"].tag
-						pullPolicy: images["hydra-maester"].pullPolicy
-					}
+					enabled: false
 				}
 				hydra: {
 					automigration: {
diff --git a/core/installer/values-tmpl/hydra-maester.cue b/core/installer/values-tmpl/hydra-maester.cue
new file mode 100644
index 0000000..4f76f84
--- /dev/null
+++ b/core/installer/values-tmpl/hydra-maester.cue
@@ -0,0 +1,42 @@
+input: {}
+
+name: "hydra-maester"
+namespace: "auth"
+
+images: {
+	hydraMaester: {
+		repository: "giolekva"
+		name: "ory-hydra-maester"
+		tag: "latest"
+		pullPolicy: "Always"
+	}
+}
+
+charts: {
+	hydraMaester: {
+		chart: "charts/hydra-maester"
+		sourceRef: {
+			kind: "GitRepository"
+			name: "pcloud"
+			namespace: global.pcloudEnvName
+		}
+	}
+}
+
+helm: {
+	"hydra-maester": {
+		chart: charts.hydraMaester
+		values: {
+			adminService: {
+				name: "foo.bar.svc.cluster.local"
+				port: 80
+				scheme: "http"
+			}
+			image: {
+				repository: images.hydraMaester.fullName
+				tag: images.hydraMaester.tag
+				pullPolicy: images.hydraMaester.pullPolicy
+			}
+		}
+	}
+}