diff --git a/services/ansible/ansible-deployment.yaml b/services/ansible/ansible-deployment.yaml
index 755ea28..967f7fd 100644
--- a/services/ansible/ansible-deployment.yaml
+++ b/services/ansible/ansible-deployment.yaml
@@ -38,6 +38,8 @@ spec:
               value: /etc/semaphore/semaphore.sqlite
             - name: SEMAPHORE_ADMIN
               value: "admin"
+            - name: SEMAPHORE_SCHEDULE_TIMEZONE
+              value: "America/New_York"
           volumeMounts:
             - name: semaphore-data
               mountPath: /etc/semaphore
diff --git a/services/matrix/matrix-livekit.yaml b/services/matrix/matrix-livekit.yaml
index d1c3fd6..f4d679a 100644
--- a/services/matrix/matrix-livekit.yaml
+++ b/services/matrix/matrix-livekit.yaml
@@ -30,6 +30,10 @@ kind: Deployment
 metadata:
   name: livekit
   namespace: matrix
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -92,6 +96,10 @@ kind: Deployment
 metadata:
   name: lk-jwt-service
   namespace: matrix
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
diff --git a/services/matrix/matrix-mas.yaml b/services/matrix/matrix-mas.yaml
index 8dbc68f..f15fd1b 100644
--- a/services/matrix/matrix-mas.yaml
+++ b/services/matrix/matrix-mas.yaml
@@ -26,12 +26,7 @@ data:
     matrix:
       homeserver: "starling.mynest.love"
       endpoint: "http://synapse-svc:8008"
-      secret: "${MAS_SYNAPSE_ADMIN_SECRET}"
-
-    clients:
-      - client_id: "0000000000000000000SYNAPSE"
-        client_auth_method: client_secret_basic
-        client_secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
+      secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
 
     upstream_oauth2:
       providers:
@@ -53,6 +48,7 @@ data:
               action: "suggest"
               template: "{{ user.email }}"
               set_email_verification: "always"
+
     secrets:
       encryption: "${MAS_ENCRYPTION_SECRET}"
       keys:
@@ -63,6 +59,10 @@ kind: Deployment
 metadata:
   name: mas
   namespace: matrix
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
diff --git a/services/matrix/matrix-synapse.yaml b/services/matrix/matrix-synapse.yaml
index 8d33271..ed1ec8c 100644
--- a/services/matrix/matrix-synapse.yaml
+++ b/services/matrix/matrix-synapse.yaml
@@ -47,13 +47,12 @@ data:
       msc4140_enabled: true
       msc4143_enabled: true
       msc4222_enabled: true
-      msc3861:
+
+    matrix_authentication_service:
         enabled: true
+        endpoint: "http://mas-svc:8080"
         issuer: "https://mas.mynest.love/"
-        client_id: "0000000000000000000SYNAPSE"
-        client_auth_method: client_secret_basic
-        client_secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
-        admin_token: "${MAS_SYNAPSE_ADMIN_SECRET}"
+        secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
       
     macaroon_secret_key: "${SYNAPSE_MACAROON_KEY}"
     form_secret: "${SYNAPSE_REGISTRATION_SECRET}"
@@ -66,6 +65,10 @@ kind: Deployment
 metadata:
   name: synapse
   namespace: matrix
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector: