diff --git a/bootstrap/argocd-config.yaml b/bootstrap/argocd-config.yaml
index e80bebc..6c736d6 100644
--- a/bootstrap/argocd-config.yaml
+++ b/bootstrap/argocd-config.yaml
@@ -111,6 +111,13 @@ spec:
               teamNameField: slug
               useLoginAsID: true
         staticClients:
+          # kubelogin uses this public client for kubectl OIDC authentication.
+          - id: kubectl
+            name: kubectl
+            public: true
+            redirectURIs:
+              - http://localhost:8000
+              - http://localhost:18000
           # Headlamp uses Dex as its OIDC provider (Dex bridges to GitHub).
           - id: headlamp
             name: Headlamp
diff --git a/operators/headlamp/application.yaml b/operators/headlamp/application.yaml
index 45b756c..c806073 100644
--- a/operators/headlamp/application.yaml
+++ b/operators/headlamp/application.yaml
@@ -4,6 +4,8 @@ kind: Application
 metadata:
   name: headlamp
   namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
   annotations:
     argocd.argoproj.io/sync-wave: "1"
 spec: