diff --git a/argocd/apps/penpot/penpot.yaml b/argocd/apps/penpot/penpot.yaml
index cbeed15..d8d7409 100644
--- a/argocd/apps/penpot/penpot.yaml
+++ b/argocd/apps/penpot/penpot.yaml
@@ -2,6 +2,8 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   name: penpot
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
@@ -42,8 +44,6 @@ spec:
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: penpot
-    labels:
-        pod-security.kubernetes.io/enforce: privileged
   syncPolicy:
     automated:
       selfHeal: true