diff --git a/.gitignore b/.gitignore
index 26ee1c2..3a63f7e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,5 +5,5 @@
 *.swo
 
 # Local plaintext twins for sync-managed secrets. Keep these untracked.
-manifest/overlays/**/secret.yaml
+manifest/overlays/*/secret.yaml
 manifest/components/**/secret.yaml
diff --git a/manifest/overlays/production/argocd-cm-patch.yaml b/manifest/overlays/production/argocd-cm-patch.yaml
index 62b7db2..1ab1ba6 100644
--- a/manifest/overlays/production/argocd-cm-patch.yaml
+++ b/manifest/overlays/production/argocd-cm-patch.yaml
@@ -94,3 +94,12 @@ data:
       - BackgroundScanReport
       - ClusterBackgroundScanReport
       - UpdateRequest
+  url: https://argocd.olb42.com
+  oidc.config: |
+    name: ZITADEL
+    issuer: https://zitadel.olb42.com
+    clientID: 370752543384470542
+    clientSecret: $oidc.zitadel.clientSecret
+    requestedScopes: ["openid", "profile", "email", "groups"]
+    requestedIDTokenClaims: {"groups": {"essential": true}}
+    enablePKCEAuthentication: true