diff --git a/manifests/02-configmap.yaml b/manifests/02-configmap.yaml
index 57f1b96..ab51ee7 100644
--- a/manifests/02-configmap.yaml
+++ b/manifests/02-configmap.yaml
@@ -3,6 +3,9 @@ kind: ConfigMap
 metadata:
   name: nextgen-be-config
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-1"  
 data:
   RADIUS_SERVER_IP: "freeradius.freeradius.svc.cluster.local"
   RADIUS_TIMEOUT_SECONDS: "2"
diff --git a/manifests/05-migration-job.yaml b/manifests/05-migration-job.yaml
index d246b1a..b49e4ff 100644
--- a/manifests/05-migration-job.yaml
+++ b/manifests/05-migration-job.yaml
@@ -6,6 +6,7 @@ metadata:
   annotations:
     # ArgoCD: run this before the Deployment is synced, on every sync where it changed
     argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "0"
     argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   backoffLimit: 2
diff --git a/manifests/secrets.example.yaml b/manifests/secrets.example.yaml
index e2dbcb9..bfe2c8e 100644
--- a/manifests/secrets.example.yaml
+++ b/manifests/secrets.example.yaml
@@ -9,6 +9,9 @@ kind: Secret
 metadata:
   name: nextgen-be-db
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Get this value with:
@@ -20,6 +23,9 @@ kind: Secret
 metadata:
   name: nextgen-be-jwt
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Generate with: openssl rand -hex 32
@@ -30,6 +36,9 @@ kind: Secret
 metadata:
   name: nextgen-be-radius
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Must match the shared secret configured on the FreeRADIUS side