diff --git a/core/installer/values-tmpl/dodo-app.cue b/core/installer/values-tmpl/dodo-app.cue
index a03566b..238b142 100644
--- a/core/installer/values-tmpl/dodo-app.cue
+++ b/core/installer/values-tmpl/dodo-app.cue
@@ -7,7 +7,7 @@
 input: {
 	network: #Network @name(Network)
 	subdomain: string @name(Subdomain)
-	sshPort: int @name(SSH Port)
+	sshPort: int @name(SSH Port) @role(port)
 	adminKey: string @name(Admin SSH Public Key)
 
 	// TODO(gio): auto generate
@@ -55,6 +55,7 @@
 
 portForward: [#PortForward & {
 	allocator: input.network.allocatePortAddr
+	reservator: input.network.reservePortAddr
 	sourcePort: input.sshPort
 	// TODO(gio): namespace part must be populated by app manager. Otherwise
 	// third-party app developer might point to a service from different namespace.
diff --git a/core/installer/values-tmpl/gerrit.cue b/core/installer/values-tmpl/gerrit.cue
index d89e0c6..c68e9ac 100644
--- a/core/installer/values-tmpl/gerrit.cue
+++ b/core/installer/values-tmpl/gerrit.cue
@@ -2,7 +2,7 @@
 	network: #Network @name(Network)
 	subdomain: string @name(Subdomain)
 	key: #SSHKey
-	sshPort: int @name(SSH Port)
+	sshPort: int @name(SSH Port) @role(port)
 }
 
 _domain: "\(input.subdomain).\(input.network.domain)"
@@ -105,6 +105,7 @@
 
 portForward: [#PortForward & {
 	allocator: input.network.allocatePortAddr
+	reservator: input.network.reservePortAddr
 	sourcePort: input.sshPort
 	// TODO(gio): namespace part must be populated by app manager. Otherwise
 	// third-party app developer might point to a service from different namespace.
diff --git a/core/installer/values-tmpl/soft-serve.cue b/core/installer/values-tmpl/soft-serve.cue
index 5c96771..10da2ac 100644
--- a/core/installer/values-tmpl/soft-serve.cue
+++ b/core/installer/values-tmpl/soft-serve.cue
@@ -1,7 +1,7 @@
 input: {
 	network: #Network @name(Network)
 	subdomain: string @name(Subdomain)
-	sshPort: int @name(SSH Port)
+	sshPort: int @name(SSH Port) @role(port)
 	adminKey: string @name(Admin SSH Public Key)
 }
 
@@ -46,6 +46,7 @@
 
 portForward: [#PortForward & {
 	allocator: input.network.allocatePortAddr
+	reservator: input.network.reservePortAddr
 	sourcePort: input.sshPort
 	// TODO(gio): namespace part must be populated by app manager. Otherwise
 	// third-party app developer might point to a service from different namespace.