diff --git a/core/installer/values-tmpl/core-auth.cue b/core/installer/values-tmpl/core-auth.cue
index 0e9f26f..391f127 100644
--- a/core/installer/values-tmpl/core-auth.cue
+++ b/core/installer/values-tmpl/core-auth.cue
@@ -230,6 +230,8 @@
 							allowed_return_urls: [
 								"https://*.\(global.domain)/",
 								"https://*.\(global.privateDomain)",
+								"http://*.\(global.domain)/", // TODO(gio): configure ingress nginx private to autoredirect
+								"http://*.\(global.privateDomain)",
 						    ]
 							methods: {
 								password: {
diff --git a/core/installer/values-tmpl/memberships.cue b/core/installer/values-tmpl/memberships.cue
index 898cffd..da70026 100644
--- a/core/installer/values-tmpl/memberships.cue
+++ b/core/installer/values-tmpl/memberships.cue
@@ -1,4 +1,6 @@
-input: {}
+input: {
+	authGroups: string
+}
 
 _subdomain: "memberships"
 _domain: "\(_subdomain).\(global.privateDomain)"
@@ -15,7 +17,7 @@
 	inp: {
 		auth: {
 			enabled: true
-			groups: "" // TODO(gio): set admin
+			groups: input.authGroups
 		}
 		network: networks.private
 		subdomain: _subdomain
diff --git a/core/installer/values-tmpl/welcome.cue b/core/installer/values-tmpl/welcome.cue
index 9ec17bc..f94a77f 100644
--- a/core/installer/values-tmpl/welcome.cue
+++ b/core/installer/values-tmpl/welcome.cue
@@ -5,8 +5,6 @@
 input: {
 	repoAddr: string
 	sshPrivateKey: string
-	createAccountAddr: string
-	loginAddr: string
 }
 
 name: "welcome"
@@ -40,6 +38,7 @@
 			sshPrivateKey: base64.Encode(null, input.sshPrivateKey)
 			createAccountAddr: "http://api.\(global.namespacePrefix)core-auth.svc.cluster.local/identities"
 			loginAddr: "https://accounts-ui.\(global.domain)"
+			membershipsInitAddr: "http://memberships.\(global.namespacePrefix)core-auth-memberships.svc.cluster.local/api/init"
 			ingress: {
 				className: _ingressPublic
 				domain: "welcome.\(global.domain)"