diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 57a88d4..aef801c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -207,7 +207,7 @@ jobs:
       contents: read
       packages: write
       id-token: write
-    uses: JorisJonkers-dev/github-workflows/.github/workflows/publish-fragment.yml@f2180a482b63756affde537233881fa12e65df70 # v0.35.0
+    uses: JorisJonkers-dev/github-workflows/.github/workflows/publish-fragment.yml@16d241e44f03c5cc4696d2d0de615717a61ef3c0 # v0.36.0
     with:
       project-file: deploy/auth.project.yml
       version: ${{ github.ref_name }}
diff --git a/deploy/auth.project.yml b/deploy/auth.project.yml
index 51229b7..1e06941 100644
--- a/deploy/auth.project.yml
+++ b/deploy/auth.project.yml
@@ -21,7 +21,6 @@ applications:
     migration: self
 
     observability:
-      alertClass: page # every forward-auth route depends on it
       scrape:
         process: auth-api
         surface: http
diff --git a/deploy/env/auth-api/base.env b/deploy/env/auth-api/base.env
index 1386d29..33c72b3 100644
--- a/deploy/env/auth-api/base.env
+++ b/deploy/env/auth-api/base.env
@@ -31,7 +31,7 @@ SPRING_CONFIG_IMPORT=vault://
 VAULT_ENABLED=true
 VAULT_ADDR=http://vault.data-system.svc.cluster.local:8200
 VAULT_AUTHENTICATION=KUBERNETES
-VAULT_KUBERNETES_ROLE=auth-api
+VAULT_KUBERNETES_ROLE=${identity:vaultRole}
 VAULT_DB_ENABLED=true
 AUTH_TRANSIT_ENABLED=true
 AUTH_TRANSIT_KEY_NAME=auth-api-jwt