diff --git a/core/installer/welcome/env.go b/core/installer/welcome/env.go
index c11770c..c0f2f01 100644
--- a/core/installer/welcome/env.go
+++ b/core/installer/welcome/env.go
@@ -564,6 +564,20 @@
 		}
 	}
 	{
+		app, err := appsRepo.Find("certificate-issuer-private")
+		if err != nil {
+			return err
+		}
+		if err := appManager.Install(*app, nsGen, emptySuffixGen, map[string]any{
+			"APIConfigMap": map[string]any{
+				"Name":      "api-config", // TODO(gio): take from global pcloud config
+				"Namespace": fmt.Sprintf("%s-dns-zone-manager", pcloudEnvName),
+			},
+		}); err != nil {
+			return err
+		}
+	}
+	{
 		app, err := appsRepo.Find("core-auth")
 		if err != nil {
 			return err
diff --git a/core/installer/welcome/welcome.go b/core/installer/welcome/welcome.go
index e13ec3a..04e0792 100644
--- a/core/installer/welcome/welcome.go
+++ b/core/installer/welcome/welcome.go
@@ -118,19 +118,6 @@
 		}
 		appsRepo := installer.NewInMemoryAppRepository(installer.CreateAllApps())
 		{
-			app, err := appsRepo.Find("certificate-issuer-private")
-			if err != nil {
-				http.Error(w, err.Error(), http.StatusInternalServerError)
-				return
-			}
-			if err := appManager.Install(*app, nsGen, suffixGen, map[string]any{
-				"GandiAPIToken": req.GandiAPIToken,
-			}); err != nil {
-				http.Error(w, err.Error(), http.StatusInternalServerError)
-				return
-			}
-		}
-		{
 			app, err := appsRepo.Find("headscale-user")
 			if err != nil {
 				http.Error(w, err.Error(), http.StatusInternalServerError)