diff --git a/deployment/zitadel/ingressRoute.yaml b/deployment/zitadel/ingressRoute.yaml
index 7ea0aae..e47f086 100644
--- a/deployment/zitadel/ingressRoute.yaml
+++ b/deployment/zitadel/ingressRoute.yaml
@@ -3,7 +3,8 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: zitadel-server
-  argocd.argoproj.io/hook: PostSync
+  annotations:
+    argocd.argoproj.io/hook: PostSync
 spec:
   entryPoints:
     - websecure
diff --git a/deployment/zitadel/secrets.yaml b/deployment/zitadel/secrets.yaml
index d7a4c82..2dda748 100644
--- a/deployment/zitadel/secrets.yaml
+++ b/deployment/zitadel/secrets.yaml
@@ -2,6 +2,8 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: zitadel-masterkey
+  annotations:
+    argocd.argoproj.io/hook: PreSync
   labels:
     secret-generator.cs.sap.com/enabled: "true"
 stringData: 
@@ -11,6 +13,8 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: cockroach-auth
+  annotations:
+    argocd.argoproj.io/hook: PreSync
   labels:
     secret-generator.cs.sap.com/enabled: "true"
 stringData: