diff --git a/init/scripts/config_gen.sh b/init/scripts/config_gen.sh
index f48f750..a3a3380 100755
--- a/init/scripts/config_gen.sh
+++ b/init/scripts/config_gen.sh
@@ -100,11 +100,14 @@ log_info "Linking Synapse and MAS via OIDC..."
 
 CLIENT_ID="synapse-client"
 CLIENT_SECRET=$(openssl rand -hex 32)
+ADMIN_SECRET=$(openssl rand -hex 32)
+MATRIX_ENDPOINT="http://synapse:8008"
 EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
 
 if [[ -z "$EXISTING_CLIENT" ]]; then
  CLIENT_OBJ="{
     \"client_id\": \"${CLIENT_ID}\",
+    \"client_auth_method\": \"client_secret_basic\",
     \"client_secret\": \"${CLIENT_SECRET}\",
     \"redirect_uris\": [\"https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback\"],
     \"grant_types\": [\"authorization_code\", \"refresh_token\"],
@@ -112,12 +115,22 @@ if [[ -z "$EXISTING_CLIENT" ]]; then
     \"scopes\": [\"openid\", \"profile\", \"email\"],
     \"application_type\": \"web\"
  }"
- yq -y -i ".clients += [$CLIENT_OBJ]" "$SYNAPSE_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
+ yq -y -i ".clients += [$CLIENT_OBJ]" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
     log_info "  -> Registered Synapse as OIDC client in MAS"
 else
     log_info "  -> Synapse client already registered in MAS, skipping"
 fi
 
+# Ensure the matrix section exists
+if ! yq '.matrix' "$MAS_CFG" > /dev/null 2>&1; then
+    yq -y -i '.matrix = {}' "$MAS_CFG"
+fi
+
+yq -y -i ".matrix.homeserver = \"${HOMESERVER_FQDN}\"" "$MAS_CFG"
+yq -y -i ".matrix.secret = \"${MATRIX_SECRET}\"" "$MAS_CFG"
+yq -y -i ".matrix.endpoint = \"${MATRIX_ENDPOINT}\"" "$MAS_CFG"
+
+
 ISSUER_URL="https://${MAS_FQDN}"
 fix_ownership "$SYNAPSE_CFG"
 
diff --git a/init/templates/main.yaml b/init/templates/main.yaml
index d101ed4..e4e0112 100644
--- a/init/templates/main.yaml
+++ b/init/templates/main.yaml
@@ -234,6 +234,7 @@ services:
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
+      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
       - "--certificatesresolvers.myresolver.acme.email=${PG_USER}@${DOMAIN}"
       - "--certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme.json"
     networks: