diff --git a/manifests/apply.sh b/manifests/apply.sh
index fd0a82e..6200485 100755
--- a/manifests/apply.sh
+++ b/manifests/apply.sh
@@ -19,3 +19,4 @@ sleep 5
 kubectl apply -k .
 
 ./immich/apply.sh
+./tailscale/apply.sh
diff --git a/manifests/nodes.yaml b/manifests/auto/nodes.yaml
similarity index 100%
rename from manifests/nodes.yaml
rename to manifests/auto/nodes.yaml
diff --git a/manifests/secrets/operator-oauth.yaml b/manifests/auto/operator-oauth.yaml
similarity index 100%
rename from manifests/secrets/operator-oauth.yaml
rename to manifests/auto/operator-oauth.yaml
diff --git a/manifests/tailscale/apply.sh b/manifests/tailscale/apply.sh
index 5ecb10f..ce3307c 100755
--- a/manifests/tailscale/apply.sh
+++ b/manifests/tailscale/apply.sh
@@ -10,6 +10,4 @@ helm upgrade \
     tailscale/tailscale-operator \
     --namespace=tailscale \
     --create-namespace \
-    --set-string oauth.clientId="$(bw get username 'ffa188a4-63b2-4926-99f0-b33b0021a4f4')" \
-    --set-string oauth.clientSecret="$(bw get password 'ffa188a4-63b2-4926-99f0-b33b0021a4f4')" \
     --wait
diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix
index 9e7d34f..e134470 100644
--- a/modules/nixos/kubernetes.nix
+++ b/modules/nixos/kubernetes.nix
@@ -123,8 +123,8 @@ in
         manifests = {
           cert-manager.source = cert-manager;
           flux.source = flux;
-          node-annotations.source = ../../manifests/nodes.yaml;
-          operator-oauth.source = ../../manifests/secrets/operator-oauth.yaml;
+          node-annotations.source = ../../manifests/auto/nodes.yaml;
+          operator-oauth.source = ../../manifests/auto/operator-oauth.yaml;
         };
         role = if cfg.agentOnly then "agent" else "server";
         serverAddr = lib.mkIf (config.networking.hostName != "isaiah") "https://isaiah.home:6443";