diff --git a/data-restorer.yaml b/data-restorer.yaml
index 89be724..b3afe8c 100644
--- a/data-restorer.yaml
+++ b/data-restorer.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: data-restorer
-  namespace: default
+  namespace: matrix
 spec:
   containers:
   - name: alpine
@@ -14,4 +14,4 @@ spec:
   volumes:
   - name: target-volume
     persistentVolumeClaim:
-      claimName: forgejo-data
+      claimName: postgres-data
diff --git a/services/matrix/matrix-admin.yaml b/services/matrix/matrix-admin.yaml
new file mode 100644
index 0000000..4bc47a9
--- /dev/null
+++ b/services/matrix/matrix-admin.yaml
@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: synapse-admin
+  namespace: matrix
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: synapse-admin
+  template:
+    metadata:
+      labels:
+        app: synapse-admin
+    spec:
+      containers:
+        - name: synapse-admin
+          image: ghcr.io/etkecc/ketesa:latest
+          ports:
+            - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: synapse-admin-svc
+  namespace: matrix
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: synapse-admin
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: synapse-admin-ingress
+  namespace: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  tls:
+    - hosts:
+      - starling-admin.mynest.love
+      secretName: synapse-admin-tls
+  rules:
+    - host: "starling-admin.mynest.love"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse-admin-svc
+                port:
+                  number: 80
diff --git a/services/matrix/matrix-mas.yaml b/services/matrix/matrix-mas.yaml
index f15fd1b..a914fd2 100644
--- a/services/matrix/matrix-mas.yaml
+++ b/services/matrix/matrix-mas.yaml
@@ -15,6 +15,7 @@ data:
             - name: compat
             - name: graphql
             - name: assets
+            - name: adminapi
           binds:
             - host: "::"
               port: 8080
diff --git a/services/nest-matrix-bot/nest-matrix-bot-deployment.yaml b/services/nest-matrix-bot/nest-matrix-bot-deployment.yaml
new file mode 100644
index 0000000..3f5b82f
--- /dev/null
+++ b/services/nest-matrix-bot/nest-matrix-bot-deployment.yaml
@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-keycloak-bot
+  namespace: default
+  labels:
+    app.kubernetes.io/name: matrix-keycloak-bot
+    app.kubernetes.io/component: automation
+spec:
+  # Maintain exactly 1 replica to prevent duplicate event handling on Matrix syncs
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: matrix-keycloak-bot
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: matrix-keycloak-bot
+    spec:
+      imagePullSecrets:
+        - name: forgejo-registry-secret
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+      containers:
+        - name: bot
+          image: weaver.mynest.love/nest/nest-matrix-bot:latest
+          imagePullPolicy: Always
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          env:
+            # --- Non-Sensitive Configuration ---
+            - name: MATRIX_HOMESERVER
+              value: "https://starling.mynest.love"
+            - name: MATRIX_BOT_USER
+              value: "@access-bot:starling.mynest.love"
+            - name: ADMIN_ROOM_ID
+              value: "!adminroomid:starling.mynest.love"
+            - name: ADMIN_MATRIX_IDS
+              value: "@nest:starling.mynest.love"
+            - name: KEYCLOAK_URL
+              value: "https://sso.mynest.love/"
+            - name: KEYCLOAK_REALM
+              value: "nest"
+            - name: KEYCLOAK_CLIENT_ID
+              value: "nest-matrix-bot"
+
+            # --- Sensitive Credentials from Vault-managed Secret ---
+            - name: MATRIX_BOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-bot-credentials
+                  key: MATRIX_BOT_PASSWORD
+            - name: KEYCLOAK_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-bot-credentials
+                  key: KEYCLOAK_CLIENT_SECRET
diff --git a/services/nest-matrix-bot/nest-matrix-bot-external-secret.yaml b/services/nest-matrix-bot/nest-matrix-bot-external-secret.yaml
new file mode 100644
index 0000000..d05fc03
--- /dev/null
+++ b/services/nest-matrix-bot/nest-matrix-bot-external-secret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: matrix-bot-credentials
+  namespace: default
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: matrix-bot-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: MATRIX_BOT_PASSWORD
+      remoteRef:
+        key: secret/data/nest/matrix-bot
+        property: bot_password
+    - secretKey: KEYCLOAK_CLIENT_SECRET
+      remoteRef:
+        key: secret/data/nest/matrix-bot
+        property: client_secret