diff --git a/apps/woodpecker/datas.tf b/apps/woodpecker/datas.tf
index 17589ea..1f2b507 100644
--- a/apps/woodpecker/datas.tf
+++ b/apps/woodpecker/datas.tf
@@ -13,7 +13,6 @@ locals {
 data "kustomization_overlay" "data" {
   namespace = var.namespace
   common_labels = local.common-labels
-  depends_on = [kubectl_manifest.server_config, kubectl_manifest.prj_secret, kubernetes_secret_v1.oauth2-client-gitea]
   resources = [for file in fileset(path.module, "*.yaml"): file if file != "index.yaml"]
   patches {
     target {
diff --git a/apps/woodpecker/index.yaml b/apps/woodpecker/index.yaml
index e49b479..ede48be 100644
--- a/apps/woodpecker/index.yaml
+++ b/apps/woodpecker/index.yaml
@@ -6,11 +6,36 @@ metadata:
   name: woodpecker
   description: null
 options:
-  issuer:
-    default: letsencrypt-prod
+  domain-name:
+    default: your_company.com
     examples:
-    - letsencrypt-prod
+    - your_company.com
     type: string
+  domain:
+    default: your-company
+    examples:
+    - your-company
+    type: string
+  storage-agent:
+    default:
+      size: 10Gi
+      storageClass: ''
+      writeMany: 'false'
+    examples:
+    - size: 10Gi
+      storageClass: ''
+      writeMany: 'false'
+    properties:
+      size:
+        default: 10Gi
+        type: string
+      storageClass:
+        default: ''
+        type: string
+      writeMany:
+        default: 'false'
+        type: string
+    type: object
   storage-server:
     default:
       accessMode: ReadWriteOnce
@@ -30,15 +55,10 @@ options:
         default: 10Gi
         type: string
     type: object
-  ingress-class:
-    default: traefik
+  issuer:
+    default: letsencrypt-prod
     examples:
-    - traefik
-    type: string
-  sub-domain:
-    default: ci
-    examples:
-    - ci
+    - letsencrypt-prod
     type: string
   images:
     default:
@@ -137,35 +157,10 @@ options:
             type: string
         type: object
     type: object
-  domain-name:
-    default: your_company.com
+  sub-domain:
+    default: ci
     examples:
-    - your_company.com
-    type: string
-  storage-agent:
-    default:
-      size: 10Gi
-      storageClass: ''
-      writeMany: 'false'
-    examples:
-    - size: 10Gi
-      storageClass: ''
-      writeMany: 'false'
-    properties:
-      size:
-        default: 10Gi
-        type: string
-      storageClass:
-        default: ''
-        type: string
-      writeMany:
-        default: 'false'
-        type: string
-    type: object
-  domain:
-    default: your-company
-    examples:
-    - your-company
+    - ci
     type: string
   timeouts:
     default:
@@ -182,6 +177,11 @@ options:
         default: '120'
         type: string
     type: object
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
 dependencies:
 - dist: null
   category: apps
diff --git a/apps/woodpecker/ressources.tf b/apps/woodpecker/ressources.tf
new file mode 100644
index 0000000..c4c45b6
--- /dev/null
+++ b/apps/woodpecker/ressources.tf
@@ -0,0 +1,45 @@
+
+# first loop through resources in ids_prio[0]
+resource "kustomization_resource" "pre" {
+  for_each = data.kustomization_overlay.data.ids_prio[0]
+
+  manifest = (
+    contains(["_/Secret"], regex("(?P<group_kind>.*/.*)/.*/.*", each.value)["group_kind"])
+    ? sensitive(data.kustomization_overlay.data.manifests[each.value])
+    : data.kustomization_overlay.data.manifests[each.value]
+  )
+}
+
+# then loop through resources in ids_prio[1]
+# and set an explicit depends_on on kustomization_resource.pre
+# wait 2 minutes for any deployment or daemonset to become ready
+resource "kustomization_resource" "main" {
+  for_each = data.kustomization_overlay.data.ids_prio[1]
+
+  manifest = (
+    contains(["_/Secret"], regex("(?P<group_kind>.*/.*)/.*/.*", each.value)["group_kind"])
+    ? sensitive(data.kustomization_overlay.data.manifests[each.value])
+    : data.kustomization_overlay.data.manifests[each.value]
+  )
+  wait = true
+  timeouts {
+    create = "5m"
+    update = "5m"
+  }
+
+  depends_on = [kustomization_resource.pre, kubectl_manifest.server_config, kubectl_manifest.prj_secret, kubernetes_secret_v1.oauth2-client-gitea]
+}
+
+# finally, loop through resources in ids_prio[2]
+# and set an explicit depends_on on kustomization_resource.main
+resource "kustomization_resource" "post" {
+  for_each = data.kustomization_overlay.data.ids_prio[2]
+
+  manifest = (
+    contains(["_/Secret"], regex("(?P<group_kind>.*/.*)/.*/.*", each.value)["group_kind"])
+    ? sensitive(data.kustomization_overlay.data.manifests[each.value])
+    : data.kustomization_overlay.data.manifests[each.value]
+  )
+
+  depends_on = [kustomization_resource.main]
+}