diff --git a/argocd/apps/penpot/penpot.yaml b/argocd/apps/penpot/penpot.yaml
index d8d7409..03c8683 100644
--- a/argocd/apps/penpot/penpot.yaml
+++ b/argocd/apps/penpot/penpot.yaml
@@ -2,8 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: penpot
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
@@ -44,6 +42,8 @@ spec:
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: penpot
+    addLabels:
+        - pod-security.kubernetes.io/enforce: "privileged"
   syncPolicy:
     automated:
       selfHeal: true