diff --git a/init/scripts/config_gen.sh b/init/scripts/config_gen.sh
index a5a3c3b..8a656f0 100755
--- a/init/scripts/config_gen.sh
+++ b/init/scripts/config_gen.sh
@@ -6,17 +6,25 @@ source "${SCRIPT_DIR}/functions.sh"
 resolve_paths
 
 require_env
+require_command "yq"
+require_command "openssl"
 require_docker
+
+# ============================================================================
+# PHASE 1: Infrastructure Setup
+# ============================================================================
+
 resolve_volume_path
 
 mkdir -p "${VOLUME_PATH}/synapse" "${VOLUME_PATH}/mas" "${VOLUME_PATH}/postgres" "${VOLUME_PATH}/proxy"
 if [[ "${WORKER_COUNT}" -gt 0 ]]; then
-mkdir -p "${VOLUME_PATH}/webapp"
+    mkdir -p "${VOLUME_PATH}/webapp"
 fi
+
 log_info "Initializing PostgreSQL..."
 docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --wait matrix-db
 
-# Wait for database readiness (silent except on failure)
+# Wait for database readiness
 for ATTEMPT in $(seq 1 60); do
     if docker compose -f "$COMPOSE_FILE" exec -T matrix-db psql -U "$PG_USER" -c "SELECT 1;" > /dev/null 2>&1; then
         break
@@ -25,7 +33,7 @@ for ATTEMPT in $(seq 1 60); do
     sleep 2
 done
 
-# Database initialization SQL
+# Database initialization
 INIT_SQL=$(cat <<EOF
 DO \$\$ BEGIN
     IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'mas') THEN
@@ -46,6 +54,10 @@ EOF
 
 echo "$INIT_SQL" | docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" exec -T matrix-db psql -U "$PG_USER" -f - > /dev/null
 
+# ============================================================================
+# PHASE 2: Configuration Generation
+# ============================================================================
+
 log_info "Generating Synapse configuration..."
 docker run -it --rm --network matrix_network \
     -v "${VOLUME_PATH}/synapse:/data" \
@@ -67,14 +79,12 @@ yq -y -i ".server_name = \"${HOMESERVER_FQDN}\"" "$SYNAPSE_CFG"
 fix_ownership "${VOLUME_PATH}/synapse"
 
 log_info "Generating MAS configuration..."
-
 docker run -it --rm --network matrix_network \
     -v "${VOLUME_PATH}/mas:/data" \
     ghcr.io/element-hq/matrix-authentication-service:latest config generate \
     | grep -v '^[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}' > "${VOLUME_PATH}/mas/config.yaml" || { log_error "Mas config generation failed"; exit 1; }
 
 MAS_CFG="${VOLUME_PATH}/mas/config.yaml"
-# Ensure 'clients' array exists (prevents errors if we try to append later)
 if ! yq '.clients' "$MAS_CFG" > /dev/null 2>&1; then
     yq -y -i '.clients = []' "$MAS_CFG"
 fi
@@ -84,4 +94,60 @@ yq -y -i ".database.uri = \"postgres://${PG_USER_MAS}:${PG_PASSWORD_MAS}@matrix-
 
 fix_ownership "${VOLUME_PATH}/mas"
 
-log_info "Configuration complete"
+# ============================================================================
+# PHASE 3: OIDC Linking
+# ============================================================================
+
+log_info "Linking Synapse and MAS via OIDC..."
+
+CLIENT_ID="synapse-client"
+CLIENT_SECRET=$(openssl rand -hex 32)
+
+TEMP_FILTER=$(mktemp)
+trap "rm -f $TEMP_FILTER" EXIT
+
+cat > "$TEMP_FILTER" <<EOF
+clients:
+  - client_id: "${CLIENT_ID}"
+    client_secret: "${CLIENT_SECRET}"
+    redirect_uris:
+      - "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
+    grant_types:
+      - "authorization_code"
+      - "refresh_token"
+    response_types:
+      - "code"
+    scopes:
+      - "openid"
+      - "profile"
+      - "email"
+    application_type: "web"
+EOF
+
+EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
+
+if [[ -z "$EXISTING_CLIENT" ]]; then
+    yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
+    log_info "  -> Registered Synapse as OIDC client in MAS"
+else
+    log_info "  -> Synapse client already registered in MAS, skipping"
+fi
+
+ISSUER_URL="https://${MAS_FQDN}"
+
+fix_ownership "$SYNAPSE_CFG"
+
+cat > "$TEMP_FILTER" <<EOF
+.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
+EOF
+
+if ! yq '.oidc_providers' "$SYNAPSE_CFG" 2>/dev/null | grep -q "idp_id"; then
+    yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
+fi
+
+if [[ "${INCLUDE_LIVEKIT:-FALSE}" == "TRUE" ]]; then
+    JWT_URL="https://${JWT_FQDN:-jwt.${DOMAIN}}"
+    yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
+fi
+
+log_info "Config generation complete"
diff --git a/init/scripts/config_link.sh b/init/scripts/config_link.sh
deleted file mode 100755
index f19f5db..0000000
--- a/init/scripts/config_link.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "${SCRIPT_DIR}/functions.sh"
-resolve_paths
-
-require_env
-require_command "yq"
-require_command "openssl"
-
-SYNAPSE_CFG="${VOLUME_PATH}/synapse/homeserver.yaml"
-MAS_CFG="${VOLUME_PATH}/mas/config.yaml"
-
-require_file "$SYNAPSE_CFG" "Synapse config"
-require_file "$MAS_CFG" "MAS config"
-
-CLIENT_ID="synapse-client"
-CLIENT_SECRET=$(openssl rand -hex 32)
-
-TEMP_FILTER=$(mktemp)
-trap "rm -f $TEMP_FILTER" EXIT
-
-cat > "$TEMP_FILTER" <<EOF
-clients:
-  - client_id: "${CLIENT_ID}"
-    client_secret: "${CLIENT_SECRET}"
-    redirect_uris:
-      - "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
-    grant_types:
-      - "authorization_code"
-      - "refresh_token"
-    response_types:
-      - "code"
-    scopes:
-      - "openid"
-      - "profile"
-      - "email"
-    application_type: "web"
-EOF
-
-EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
-
-if [[ -z "$EXISTING_CLIENT" ]]; then
-    # Append new client to MAS config
-    yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
-    log_info "  -> Registered Synapse as OIDC client in MAS"
-else
-    log_info "  -> Synapse client already registered in MAS, skipping"
-fi
-
-ISSUER_URL="https://${MAS_FQDN}"
-
-fix_ownership "$SYNAPSE_CFG"
-
-cat > "$TEMP_FILTER" <<EOF
-.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
-EOF
-
-if ! yq '.oidc_providers' "$SYNAPSE_CFG" 2>/dev/null | grep -q "idp_id"; then
-    yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
-fi
-
-if [[ "${INCLUDE_LIVEKIT}" == "TRUE" ]]; then
-    JWT_URL="https://${JWT_FQDN:-jwt.${DOMAIN}}"
-    yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
-fi
-
-log_info "OIDC and LiveKit linking complete"