diff --git a/config/app.ini b/config/app.ini
index 32f85a3..349d8d1 100644
--- a/config/app.ini
+++ b/config/app.ini
@@ -540,10 +540,10 @@ ENABLED = false
 ;;
 ;; OAuth2 authentication secret for access and refresh tokens, change this yourself to a unique string. CLI generate option is helpful in this case. https://docs.gitea.io/en-us/command-line/#generate
 ;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to HS256, HS384 or HS512.
-;JWT_SECRET =
+JWT_SECRET =
 ;;
 ;; Alternative location to specify OAuth2 authentication secret. You cannot specify both this and JWT_SECRET, and must pick one
-;JWT_SECRET_URI = file:/etc/gitea/oauth2_jwt_secret
+JWT_SECRET_URI = file:/etc/gitea/secrets/oauth2_jwt_secret
 ;;
 ;; Lifetime of an OAuth2 access token in seconds
 ;ACCESS_TOKEN_EXPIRATION_TIME = 3600
@@ -2035,6 +2035,17 @@ ENABLED = true
 ;;   or only create new users if UPDATE_EXISTING is set to false
 ;UPDATE_EXISTING = true
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; Cleanup expired actions assets
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[cron.cleanup_actions]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;ENABLED = true
+;RUN_AT_START = true
+;SCHEDULE = @midnight
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Clean-up deleted branches
diff --git a/diff.sh b/diff.sh
index 59ed8cf..7f6eb72 100755
--- a/diff.sh
+++ b/diff.sh
@@ -2,6 +2,6 @@
 
 URL='https://raw.githubusercontent.com'
 REPO='go-gitea/gitea'
-TAG="v$(awk -F: '/^IMAGEAPP/{sub("-rootless", ""); print $2}' .env)"
+TAG="release/v$(awk -F: '/^IMAGEAPP/{sub(".[0-9]+-rootless", ""); print $2}' .env)"
 
-$EDITOR -d -c "wincmd l" -- "$URL/$REPO/$TAG/custom/conf/app.example.ini" app.ini
+$EDITOR -d -c "wincmd l" -- "$URL/$REPO/$TAG/custom/conf/app.example.ini" config/app.ini
diff --git a/manifests/bin/deploy.sh b/manifests/bin/deploy.sh
index fb8a6bc..7264461 100755
--- a/manifests/bin/deploy.sh
+++ b/manifests/bin/deploy.sh
@@ -52,7 +52,8 @@ kcreatesec gitea-admin \
 
 kcreatesec gitea \
     --from-literal=secret_key="$(kgseckey gitea secret_key || openssl rand -hex 32)" \
-    --from-literal=internal_token="$(kgseckey gitea internal_token || openssl rand -hex 32)"
+    --from-literal=internal_token="$(kgseckey gitea internal_token || openssl rand -hex 32)" \
+    --from-literal=oauth2_jwt_secret="$(kgseckey gitea oauth2_jwt_secret || openssl rand -hex 32)"
 
 kcreatecm gitea \
     --from-file=app.ini=<(envsubst "$(env | xargs printf '$%s ')" < config/app.ini)