diff --git a/everything-app/cilium-settings.yaml b/everything-app/cilium-settings.yaml
index c0aef8e..8fe8827 100644
--- a/everything-app/cilium-settings.yaml
+++ b/everything-app/cilium-settings.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/cilium-settings
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/cloudtube.yaml b/everything-app/cloudtube.yaml
index c815d99..7a5e725 100644
--- a/everything-app/cloudtube.yaml
+++ b/everything-app/cloudtube.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/cloudtube
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/csi4samba.yaml b/everything-app/csi4samba.yaml
index 7d34f6b..7618774 100644
--- a/everything-app/csi4samba.yaml
+++ b/everything-app/csi4samba.yaml
@@ -12,3 +12,6 @@ spec:
     chart: csi-driver-smb
     repoURL: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
     targetRevision: v1.13.0
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/external-dns.yaml b/everything-app/external-dns.yaml
index da82651..51ea49f 100644
--- a/everything-app/external-dns.yaml
+++ b/everything-app/external-dns.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/external-dns
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/lidarr.yaml b/everything-app/lidarr.yaml
index 767d924..1d03d85 100644
--- a/everything-app/lidarr.yaml
+++ b/everything-app/lidarr.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/lidarr
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/lms.yaml b/everything-app/lms.yaml
index fb34ed1..d425be3 100644
--- a/everything-app/lms.yaml
+++ b/everything-app/lms.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/lms
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/newleaf.yaml b/everything-app/newleaf.yaml
index d1229c2..ddffea4 100644
--- a/everything-app/newleaf.yaml
+++ b/everything-app/newleaf.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/newleaf
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/project-apps.yaml b/everything-app/project-apps.yaml
index 52c2051..bc0c418 100644
--- a/everything-app/project-apps.yaml
+++ b/everything-app/project-apps.yaml
@@ -5,15 +5,18 @@ metadata:
   namespace: argocd
 spec:
   clusterResourceWhitelist:
-  - group: "*"
-    kind: "*"
+    - group: '*'
+      kind: '*'
   clusterResourceBlacklist:
-  - group: cilium.io
-    kind: CiliumIdentity
+    - group: cilium.io
+      kind: CiliumIdentity
   description: everything non-infra
   sourceRepos:
-  - https://git.martyn.berlin/martyn/infra4talos.git
+    - https://git.martyn.berlin/martyn/infra4talos.git
   destinations:
-  - name: '*'
-    namespace: '*'
-    server: https://kubernetes.default.svc
+    - name: '*'
+      namespace: '*'
+      server: https://kubernetes.default.svc
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/project-infra.yaml b/everything-app/project-infra.yaml
index f70fe6e..08590cf 100644
--- a/everything-app/project-infra.yaml
+++ b/everything-app/project-infra.yaml
@@ -7,25 +7,28 @@ metadata:
   namespace: argocd
 spec:
   clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
+    - group: '*'
+      kind: '*'
   clusterResourceBlacklist:
-  - group: cilium.io
-    kind: CiliumIdentity
+    - group: cilium.io
+      kind: CiliumIdentity
   description: argo, nginx-ingress, etc.
   destinations:
-  - name: '*'
-    namespace: '*'
-    server: https://kubernetes.default.svc
+    - name: '*'
+      namespace: '*'
+      server: https://kubernetes.default.svc
   sourceRepos:
-  - https://git.martyn.berlin/martyn/infra4talos.git
-  - https://github.com/argoproj/argo-cd
-  - https://1password.github.io/connect-helm-charts/
-  - https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
-  - https://github.com/MeisterLabs/secrets-store-csi-driver-provider-1password
-  - https://kubernetes.github.io/ingress-nginx
-  - https://charts.jetstack.io
-  - https://charts.neoskop.dev
-  - https://helm.cilium.io/
-  - https://openebs.github.io/mayastor-extensions/
-  - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
+    - https://git.martyn.berlin/martyn/infra4talos.git
+    - https://github.com/argoproj/argo-cd
+    - https://1password.github.io/connect-helm-charts/
+    - https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
+    - https://github.com/MeisterLabs/secrets-store-csi-driver-provider-1password
+    - https://kubernetes.github.io/ingress-nginx
+    - https://charts.jetstack.io
+    - https://charts.neoskop.dev
+    - https://helm.cilium.io/
+    - https://openebs.github.io/mayastor-extensions/
+    - https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/smb-storageclasses.yaml b/everything-app/smb-storageclasses.yaml
index 0f2eb43..062fbb3 100644
--- a/everything-app/smb-storageclasses.yaml
+++ b/everything-app/smb-storageclasses.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/smb-storageclasses
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'
diff --git a/everything-app/whoogle.yaml b/everything-app/whoogle.yaml
index e5e11e6..0714ef6 100644
--- a/everything-app/whoogle.yaml
+++ b/everything-app/whoogle.yaml
@@ -12,3 +12,6 @@ spec:
     path: apps-kustomized/whoogle
     repoURL: https://git.martyn.berlin/martyn/infra4talos
     targetRevision: HEAD
+  sycPolicy:
+    automated:
+      selfHeal: 'true'