diff --git a/apps/keycloak/kustomization.yaml b/apps/keycloak/kustomization.yaml
index 51517e8..b996eca 100644
--- a/apps/keycloak/kustomization.yaml
+++ b/apps/keycloak/kustomization.yaml
@@ -3,5 +3,3 @@ resources:
   - namespace.yaml
   - operatorgroup.yaml
   - subscription.yaml
-  - instances.yaml
-  - realm.yaml
diff --git a/apps/keycloak/realm.yaml b/apps/keycloak/realm.yaml
deleted file mode 100644
index 779ce6a..0000000
--- a/apps/keycloak/realm.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-apiVersion: keycloak.org/v1alpha1
-kind: KeycloakRealm
-metadata:
-  name: fcos-keycloak-realm
-  labels:
-    app: sso
-spec:
-  realm:
-    id: fcos
-    realm: fcos
-    enabled: true
-    displayName: Fab City OS Realm
-  instanceSelector:
-    matchLabels:
-      app: sso
diff --git a/apps/keycloak/subscription.yaml b/apps/keycloak/subscription.yaml
index e4fb8c1..8bd6e5d 100644
--- a/apps/keycloak/subscription.yaml
+++ b/apps/keycloak/subscription.yaml
@@ -5,7 +5,7 @@ metadata:
   name: keycloak
   namespace: keycloak
 spec:
-  channel: alpha
+  channel: candidate
   name: keycloak-operator
   source: operatorhubio-catalog
   sourceNamespace: olm
diff --git a/apps/keycloak/instances.yaml b/overlays/dev/apps/keycloak/instances.yaml
similarity index 50%
rename from apps/keycloak/instances.yaml
rename to overlays/dev/apps/keycloak/instances.yaml
index 4d06bc2..3a29419 100644
--- a/apps/keycloak/instances.yaml
+++ b/overlays/dev/apps/keycloak/instances.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: keycloak.org/v1alpha1
+apiVersion: k8s.keycloak.org/v2alpha1
 kind: Keycloak
 metadata:
   name: fcos-keycloak
@@ -7,5 +7,5 @@ metadata:
     app: sso
 spec:
   instances: 1
-  externalAccess:
-    enabled: true
+  hostname: id.localhost
+  tlsSecret: INSECURE-DISABLE
diff --git a/overlays/dev/apps/keycloak/kustomization.yaml b/overlays/dev/apps/keycloak/kustomization.yaml
new file mode 100644
index 0000000..99208d9
--- /dev/null
+++ b/overlays/dev/apps/keycloak/kustomization.yaml
@@ -0,0 +1,3 @@
+---
+resources:
+  - instances.yaml
diff --git a/overlays/dev/kustomization.yaml b/overlays/dev/kustomization.yaml
index c39e8de..20549da 100644
--- a/overlays/dev/kustomization.yaml
+++ b/overlays/dev/kustomization.yaml
@@ -1,6 +1,7 @@
 ---
 resources:
   - ../../base
+  - ./apps/keycloak
 patches:
   - target:
       kind: Ingress
diff --git a/overlays/prod/apps/keycloak/instances.yaml b/overlays/prod/apps/keycloak/instances.yaml
new file mode 100644
index 0000000..c4c6535
--- /dev/null
+++ b/overlays/prod/apps/keycloak/instances.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: fcos-keycloak
+  labels:
+    app: sso
+spec:
+  instances: 2
+  hostname: id.fabcity.hamburg
+  tlsSecret: fcos-keycloak-tls-secret
diff --git a/overlays/prod/apps/keycloak/kustomization.yaml b/overlays/prod/apps/keycloak/kustomization.yaml
new file mode 100644
index 0000000..99208d9
--- /dev/null
+++ b/overlays/prod/apps/keycloak/kustomization.yaml
@@ -0,0 +1,3 @@
+---
+resources:
+  - instances.yaml
diff --git a/overlays/prod/kustomization.yaml b/overlays/prod/kustomization.yaml
index 1490833..08ae2ea 100644
--- a/overlays/prod/kustomization.yaml
+++ b/overlays/prod/kustomization.yaml
@@ -2,6 +2,7 @@
 resources:
   - ../../base
   - ./apps/cert-manager
+  - ./apps/keycloak
   - ./apps/gitea
 patches:
   - target: