diff --git a/.env b/.env
index 15501e1..ea69377 100644
--- a/.env
+++ b/.env
@@ -1,3 +1,3 @@
 PROD_URL=git.gmoker.com
-IMAGEAPP=docker.io/gitea/gitea:1.22.2-rootless
-IMAGERUNNER=docker.io/gitea/act_runner:0.2.10-dind-rootless
+IMAGEAPP=docker.io/gitea/gitea:1.22.6-rootless
+IMAGERUNNER=docker.io/gitea/act_runner:0.2.11-dind-rootless
diff --git a/manifests/bin/createadmin.sh b/manifests/bin/createadmin.sh
index 0c3c0c9..3f372e4 100755
--- a/manifests/bin/createadmin.sh
+++ b/manifests/bin/createadmin.sh
@@ -28,6 +28,6 @@ fi
 
 kcreatesec "$SECRET" \
     --from-literal=email="$NAME@$BASE_URL" \
-    --from-literal=username="$SECRET" \
+    --from-literal=username="$NAME" \
     --from-literal=password="$p" \
     "${opts[@]}"
diff --git a/manifests/bin/deploy.sh b/manifests/bin/deploy.sh
index 2f10d1e..4ba4027 100755
--- a/manifests/bin/deploy.sh
+++ b/manifests/bin/deploy.sh
@@ -4,7 +4,7 @@ set -o pipefail
 function kapply() {
     for f in "$@"; do
         kubectl apply -f \
-            <(envsubst "$(env | xargs printf '$%s ')" < "manifests/$f")
+            <(envsubst "$(env | xargs -0 printf '$%s ')" < "manifests/$f")
     done
 }; export -f kapply
 
@@ -55,7 +55,7 @@ kcreatesec gitea \
 kubectl delete pod secrets
 
 kcreatecm gitea \
-    --from-file=app.ini=<(envsubst "$(env | xargs printf '$%s ')" < config/app.ini)
+    --from-file=app.ini=<(envsubst "$(env | xargs -0 printf '$%s ')" < config/app.ini)
 
 kapply common/job.yaml \
     common/valkey.yaml \