diff --git a/bundle/config/00-schema.yaml b/bundle/config/00-schema.yaml
index c49eb77..da88e3f 100644
--- a/bundle/config/00-schema.yaml
+++ b/bundle/config/00-schema.yaml
@@ -7,7 +7,7 @@
 #! of the application.
 
 applicationNamespace:
-  name: "educates-lookup"
+  name: "educates-lookup-service"
   exists: false
 
 configurationNamespace:
diff --git a/config/app.yaml b/config/app.yaml
new file mode 100644
index 0000000..70a704f
--- /dev/null
+++ b/config/app.yaml
@@ -0,0 +1,26 @@
+apiVersion: kappctrl.k14s.io/v1alpha1
+kind: App
+metadata:
+  name: educates-lookup-service-installer.educates.dev
+  namespace: educates-lookup-service-installer
+spec:
+  serviceAccountName: educates-lookup-service-installer
+  syncPeriod: 87600h #! 10 years
+  fetch:
+  - imgpkgBundle:
+      image: ghcr.io/educates/educates-lookup-service-installer:main
+  template:
+  - ytt:
+      paths:
+      - config
+      valuesFrom:
+      - secretRef:
+          name: educates-lookup-service-values
+  - kbld:
+      paths:
+      - .imgpkg/images.yml
+      - '-'
+  deploy:
+  - kapp:
+      rawOptions:
+      - --app-changes-max-to-keep=5
diff --git a/config/rbac.yaml b/config/rbac.yaml
new file mode 100644
index 0000000..3b4cd5b
--- /dev/null
+++ b/config/rbac.yaml
@@ -0,0 +1,24 @@
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: educates-lookup-service-installer
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: educates-lookup-service-installer
+  namespace: educates-lookup-service-installer
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: educates-lookup-service-installer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: educates-lookup-service-installer
+    namespace: educates-lookup-service-installer