diff --git a/flux2/apps/monitoring/eventrouter-values-configmap.yaml b/flux2/apps/monitoring/eventrouter-values-configmap.yaml
index 65b6d671012d99cb416362210edae62aad3d4d94..fa7d5eb712ca6608cf8e7684b88f6db44038c487 100644
--- a/flux2/apps/monitoring/eventrouter-values-configmap.yaml
+++ b/flux2/apps/monitoring/eventrouter-values-configmap.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: stackspin-eventrouter-values
+  namespace: stackspin
 data:
   values.yaml: |
     sink: stdout
diff --git a/flux2/apps/monitoring/kube-prometheus-stack-oauth-client.yaml b/flux2/apps/monitoring/kube-prometheus-stack-oauth-client.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..82106d0d4bc42cf12f08de55090f643aa734f12b
--- /dev/null
+++ b/flux2/apps/monitoring/kube-prometheus-stack-oauth-client.yaml
@@ -0,0 +1,22 @@
+apiVersion: hydra.ory.sh/v1alpha1
+kind: OAuth2Client
+metadata:
+  name: kube-prometheus-stack-oauth-client
+  # Has to live in the same namespace as the stackspin-wordpress-oauth-variables
+  # secret
+  namespace: flux-system
+spec:
+  grantTypes:
+    - authorization_code
+    - refresh_token
+    - client_credentials
+  responseTypes:
+    - id_token
+    - code
+  scope: "openid profile email stackspin_roles"
+  secretName: stackspin-kube-prometheus-stack-oauth-variables
+  # these are optional
+  redirectUris:
+    - https://grafana.${domain}/login/generic_oauth
+  # hydraAdmin: {}
+  tokenEndpointAuthMethod: client_secret_post
diff --git a/flux2/apps/monitoring/kube-prometheus-stack-values-configmap.yaml b/flux2/apps/monitoring/kube-prometheus-stack-values-configmap.yaml
index 479ad58d58695610b6b65b69c874d7e339fb51e1..11bb919a29d7656df58096de21a4abe3639366d4 100644
--- a/flux2/apps/monitoring/kube-prometheus-stack-values-configmap.yaml
+++ b/flux2/apps/monitoring/kube-prometheus-stack-values-configmap.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: stackspin-kube-prometheus-stack-values
+  namespace: stackspin
 data:
   values.yaml: |
     # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
diff --git a/flux2/apps/monitoring/kustomization.yaml b/flux2/apps/monitoring/kustomization.yaml
index 1b30e22f87d3dd1eec895cc42580c1f9e9d87519..d3c8daccb628557825f849a4f4852a5407673dfb 100644
--- a/flux2/apps/monitoring/kustomization.yaml
+++ b/flux2/apps/monitoring/kustomization.yaml
@@ -1,10 +1,10 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: stackspin
 resources:
   - eventrouter-release.yaml
   - eventrouter-values-configmap.yaml
+  - kube-prometheus-stack-oauth-client.yaml
   - kube-prometheus-stack-release.yaml
   - kube-prometheus-stack-values-configmap.yaml
   - loki-configmap.yaml
diff --git a/flux2/apps/monitoring/loki-values-configmap.yaml b/flux2/apps/monitoring/loki-values-configmap.yaml
index 86ec319cb6148f990373e68d1513f94166ef188b..ca408a8ea2b0d927944d8457a13f35cfc33bf19b 100644
--- a/flux2/apps/monitoring/loki-values-configmap.yaml
+++ b/flux2/apps/monitoring/loki-values-configmap.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: stackspin-loki-values
+  namespace: stackspin
 data:
   values.yaml: |
     # https://github.com/grafana/helm-charts/blob/main/charts/loki/values.yaml
diff --git a/flux2/apps/monitoring/promtail-values-configmap.yaml b/flux2/apps/monitoring/promtail-values-configmap.yaml
index 83472dccb006b3465f184ee46bfc5357b1e1cf80..d32575cf5f1ab400642d730570fdfbc3dd6e3fe2 100644
--- a/flux2/apps/monitoring/promtail-values-configmap.yaml
+++ b/flux2/apps/monitoring/promtail-values-configmap.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: stackspin-promtail-values
+  namespace: stackspin
 data:
   values.yaml: |
     initContainer:
diff --git a/flux2/apps/monitoring/pvc.yaml b/flux2/apps/monitoring/pvc.yaml
index c8c46cda125d5f05fe64b8a31860468018086b09..4b96bcc6b6ffb9ada60c0916911760c56b9ebf9f 100644
--- a/flux2/apps/monitoring/pvc.yaml
+++ b/flux2/apps/monitoring/pvc.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: grafana
+  namespace: stackspin
 spec:
   accessModes:
     - ReadWriteOnce
diff --git a/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml b/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml
index bb8415068b4170c93dc660ecfb681ce9a741e122..da36230613bfaed1d151ef3109c93782cfeac239 100644
--- a/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml
+++ b/flux2/core/base/single-sign-on/single-sign-on-values-configmap.yaml
@@ -109,20 +109,6 @@ data:
         - "authorization_code"
         - "refresh_token"
         - "client_credentials"
-    - clientName: grafana
-      clientSecret: "${grafana_oauth_client_secret}"
-      redirectUri: "https://grafana.${domain}/login/generic_oauth"
-      scopes: "openid profile email stackspin_roles"
-      clientUri: "https://grafana.${domain}"
-      clientLogoUri: "https://grafana.${domain}/public/img/grafana_icon.svg"
-      tokenEndpointAuthMethod: "client_secret_post"
-      responseTypes:
-        - "code"
-        - "id_token"
-      grantTypes:
-        - "authorization_code"
-        - "refresh_token"
-        - "client_credentials"
     # https://github.com/wekan/wekan/wiki/Keycloak
     - clientName: wekan
       clientSecret: "${wekan_oauth_client_secret}"
diff --git a/install/generate_secrets.py b/install/generate_secrets.py
index 04a1896f2286c90c4fdfcb4f420184b5d8896e6f..3640fd75d388c12aebd4134318a5121c008f501a 100644
--- a/install/generate_secrets.py
+++ b/install/generate_secrets.py
@@ -25,6 +25,14 @@ from kubernetes import client, config
 from kubernetes.client.exceptions import ApiException
 from kubernetes.utils import create_from_yaml
 
+# This script gets called with an app name as argument. Most of them need an
+# oauth client in Hydra, but some don't. This list contains the ones that
+# don't.
+APPS_WITHOUT_OAUTH = [
+    "single-sign-on",
+    "prometheus",
+    "alertmanager",
+]
 
 def main():
     """Run everything"""
@@ -37,9 +45,11 @@ def main():
         sys.exit(1)
     app_name = sys.argv[1]
 
-    # Create app variables secret and oauth variables secret
-    for secret in [app_name, f"{app_name}-oauth"]:
-        create_variables_secret(f"stackspin-{secret}-variables.yaml.jinja", env)
+    # Create app variables secret
+    create_variables_secret(app_name, f"stackspin-{app_name}-variables.yaml.jinja", env)
+    # Create a secret that contains the oauth variables for Hydra Maester
+    if app_name not in APPS_WITHOUT_OAUTH:
+        create_variables_secret(app_name, "stackspin-oauth-variables.yaml.jinja", env)
     create_basic_auth_secret(app_name, env)
 
 
@@ -49,7 +59,7 @@ def get_templates_dir():
     return os.path.join(os.path.dirname(os.path.realpath(__file__)), 'templates')
 
 
-def create_variables_secret(variables_filename, env):
+def create_variables_secret(app_name, variables_filename, env):
     """Checks if a variables secret for app_name already exists, generates it if necessary"""
     variables_filepath = \
         os.path.join(get_templates_dir(), variables_filename)
@@ -58,7 +68,11 @@ def create_variables_secret(variables_filename, env):
         with open(variables_filepath) as template_file:
             lines = template_file.read()
             secret_name, secret_namespace = get_secret_metadata(lines)
-            new_secret_dict = yaml.safe_load(env.from_string(lines).render())
+            new_secret_dict = yaml.safe_load(
+                env.from_string(
+                    lines,
+                    globals={"app": app_name}
+                ).render())
             current_secret_data = get_kubernetes_secret_data(secret_name,
                     secret_namespace)
             if current_secret_data is None:
diff --git a/install/install-stackspin.sh b/install/install-stackspin.sh
index d913734f3db48e515e32c37e9b9232e34efab1b8..dacde30341b765b95a5a631193ca631e50a5d04e 100755
--- a/install/install-stackspin.sh
+++ b/install/install-stackspin.sh
@@ -37,10 +37,9 @@ echo "Tracking branch $branch for https://open.greenhost.net/stackspin/stackspin
 kubectl get namespace stackspin 2>/dev/null || kubectl create namespace stackspin
 kubectl get namespace stackspin-apps 2>/dev/null || kubectl create namespace stackspin-apps
 
-# Generate oauth and SSO secrets
+# Generate dashboard and SSO secrets
 python "$(dirname "$0")/generate_secrets.py" dashboard
 python "$(dirname "$0")/generate_secrets.py" single-sign-on
-python "$(dirname "$0")/generate_secrets.py" oauth
 
 # Generate secrets for monitoring
 python "$(dirname "$0")/generate_secrets.py" kube-prometheus-stack
diff --git a/install/templates/stackspin-oauth-variables.yaml.jinja b/install/templates/stackspin-oauth-variables.yaml.jinja
index 66445dd80fe4c04d15d5f39be141a5b03c6306f0..32a0ab0785d45ed113a39706af4b1c4f8601e080 100644
--- a/install/templates/stackspin-oauth-variables.yaml.jinja
+++ b/install/templates/stackspin-oauth-variables.yaml.jinja
@@ -2,12 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: stackspin-oauth-variables
+  name: stackspin-{{ app }}-oauth-variables
 data:
-  grafana_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
-  nextcloud_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
-  userpanel_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
-  wekan_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
-  wordpress_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
-  zulip_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
-  dashboard_oauth_client_secret: "{{ 32 | generate_password | b64encode }}"
+  client_id: "{{ app | b64encode }}"
+  client_secret: "{{ 32 | generate_password | b64encode }}"
diff --git a/install/templates/stackspin-wordpress-oauth-variables.yaml.jinja b/install/templates/stackspin-wordpress-oauth-variables.yaml.jinja
deleted file mode 100644
index 4fbb548e3b6a6b049a2e1e2b2b3b4739f791b7dc..0000000000000000000000000000000000000000
--- a/install/templates/stackspin-wordpress-oauth-variables.yaml.jinja
+++ /dev/null
@@ -1,8 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: stackspin-wordpress-oauth-variables
-data:
-  client_id: "{{ 'wordpress' | b64encode }}"
-  client_secret: "{{ 32 | generate_password | b64encode }}"