diff --git a/flux/clusters/flux-system/receiver.yaml b/flux/clusters/flux-system/receiver.yaml
index 40338e2..ec2f187 100644
--- a/flux/clusters/flux-system/receiver.yaml
+++ b/flux/clusters/flux-system/receiver.yaml
@@ -1,16 +1,16 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
-annotations:
-  # https://cert-manager.io/docs/usage/ingress/#supported-annotations
-  # https://github.com/cert-manager/cert-manager/issues/2239
-  cert-manager.io/cluster-issuer: letsencrypt-http
-  cert-manager.io/private-key-algorithm: ECDSA
-  cert-manager.io/private-key-size: 384
-  kubernetes.io/ingress.class: traefik
-  traefik.ingress.kubernetes.io/router.entrypoints: websecure
 metadata:
   name: webhook-flux-receiver
   namespace: flux-system
+  annotations:
+    # https://cert-manager.io/docs/usage/ingress/#supported-annotations
+    # https://github.com/cert-manager/cert-manager/issues/2239
+    cert-manager.io/cluster-issuer: letsencrypt-http
+    cert-manager.io/private-key-algorithm: ECDSA
+    cert-manager.io/private-key-size: 384
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
   rules:
   - host: flux.k8s.forgejo.org