diff --git a/argocd/apps/penpot/penpot.yaml b/argocd/apps/penpot/penpot.yaml
index 03c8683..a225fef 100644
--- a/argocd/apps/penpot/penpot.yaml
+++ b/argocd/apps/penpot/penpot.yaml
@@ -42,11 +42,11 @@ spec:
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: penpot
-    addLabels:
-        - pod-security.kubernetes.io/enforce: "privileged"
   syncPolicy:
     automated:
       selfHeal: true
       prune: true
     syncOptions:
       - CreateNamespace=true
+    addLabels:
+        - pod-security.kubernetes.io/enforce=privileged