diff --git a/app/matrix/lib/cas.libsonnet b/app/matrix/lib/cas.libsonnet
index f1de4fe..4c70b45 100644
--- a/app/matrix/lib/cas.libsonnet
+++ b/app/matrix/lib/cas.libsonnet
@@ -13,8 +13,9 @@
     },
 
     ns:: error "ns needs to be a kube.Namespace object",
+    local ns = app.ns,
 
-    deployment: app.ns.Contain(kube.Deployment("oauth2-cas-proxy")) {
+    deployment: ns.Contain(kube.Deployment("oauth2-cas-proxy")) {
         spec+: {
             replicas: 1,
             template+: {
@@ -42,7 +43,7 @@
         },
     },
 
-    svc: app.ns.Contain(kube.Service("oauth2-cas-proxy")) {
+    svc: ns.Contain(kube.Service("oauth2-cas-proxy")) {
         target:: app.deployment,
     },
 }
diff --git a/app/matrix/lib/coturn.libsonnet b/app/matrix/lib/coturn.libsonnet
index f1b127b..cfb5024 100644
--- a/app/matrix/lib/coturn.libsonnet
+++ b/app/matrix/lib/coturn.libsonnet
@@ -15,8 +15,9 @@
     },
 
     ns:: error "ns needs to be provided",
+    local ns = app.ns,
 
-    configMap: app.ns.Contain(kube.ConfigMap("coturn")) {
+    configMap: ns.Contain(kube.ConfigMap("coturn")) {
         data: {
             "coturn.conf": |||
                 # VoIP traffic is all UDP. There is no reason to let users connect to arbitrary TCP endpoints via the relay.
@@ -59,12 +60,12 @@
         },
     },
 
-    dataVolume: app.ns.Contain(kube.PersistentVolumeClaim("coturn-data")) {
+    dataVolume: ns.Contain(kube.PersistentVolumeClaim("coturn-data")) {
         storage:: "10Gi",
         storageClass:: cfg.storageClassName,
     },
 
-    deployment: app.ns.Contain(kube.Deployment("coturn")) {
+    deployment: ns.Contain(kube.Deployment("coturn")) {
         spec+: {
             replicas: 1,
             template+: {
@@ -129,7 +130,7 @@
         },
     },
 
-    svcTCP: app.ns.Contain(kube.Service("coturn-tcp")) {
+    svcTCP: ns.Contain(kube.Service("coturn-tcp")) {
         target:: app.deployment,
         metadata+: {
             annotations+: {
@@ -149,7 +150,7 @@
         },
     },
 
-    svcUDP: app.ns.Contain(kube.Service("coturn-udp")) {
+    svcUDP: ns.Contain(kube.Service("coturn-udp")) {
         target:: app.deployment,
         metadata+: {
             annotations+: {
diff --git a/app/matrix/lib/matrix-ng.libsonnet b/app/matrix/lib/matrix-ng.libsonnet
index 18120f0..620a8d5 100644
--- a/app/matrix/lib/matrix-ng.libsonnet
+++ b/app/matrix/lib/matrix-ng.libsonnet
@@ -243,7 +243,7 @@
         },
     },
 
-    namespace: kube.Namespace(cfg.namespace),
+    local ns = kube.Namespace(cfg.namespace),
 
     postgres3: if cfg.postgres.enable then postgres {
         local psql = self,
@@ -282,7 +282,7 @@
     },
 
     riot: riot {
-        ns: app.namespace,
+        ns: ns,
         cfg+: {
             webDomain: cfg.webDomain,
             serverName: cfg.serverName,
@@ -292,7 +292,7 @@
 
     cas: if cfg.cas.enable && cfg.oidc.enable then error "cfg.cas.enable and cfg.oidc.enable options are exclusive"
         else if cfg.cas.enable then cas {
-        ns: app.namespace,
+        ns: ns,
         cfg+: {
             image: cfg.images.casProxy,
             webDomain: cfg.webDomain,
@@ -301,7 +301,7 @@
     },
 
     wellKnown: if cfg.wellKnown then wellKnown {
-        ns: app.namespace,
+        ns: ns,
         cfg+: {
             image: cfg.images.wellKnown,
             webDomain: cfg.webDomain,
@@ -309,7 +309,7 @@
     } else {},
 
     mediaRepo: if cfg.mediaRepo.enable then mediaRepo {
-        ns: app.namespace,
+        ns: ns,
         cfg+: {
             image: cfg.images.mediaRepo,
 
@@ -324,7 +324,7 @@
     } else {},
 
     coturn: if cfg.coturn.enable then coturn {
-        ns: app.namespace,
+        ns: ns,
         cfg+: {
             storageClassName: cfg.storageClassName,
             image: cfg.images.coturn,
@@ -335,7 +335,7 @@
     } else null,
 
     synapse: synapse {
-        ns: app.namespace,
+        ns: ns,
         postgres: if cfg.postgres.enable then app.postgres3 else {
             # If not using on-cluster postgres, pass the config postgres object
             # as the postgres object into the synapse lib. It's a bit ugly (we
diff --git a/app/matrix/lib/matrix.libsonnet b/app/matrix/lib/matrix.libsonnet
index 29cdaf5..fef0bd8 100644
--- a/app/matrix/lib/matrix.libsonnet
+++ b/app/matrix/lib/matrix.libsonnet
@@ -80,7 +80,7 @@
         },
     },
 
-    namespace: kube.Namespace(cfg.namespace),
+    local ns = kube.Namespace(cfg.namespace),
 
     postgres3: postgres {
         cfg+: {
diff --git a/app/matrix/lib/media-repo.libsonnet b/app/matrix/lib/media-repo.libsonnet
index 4b079d8..275be24 100644
--- a/app/matrix/lib/media-repo.libsonnet
+++ b/app/matrix/lib/media-repo.libsonnet
@@ -27,6 +27,7 @@
     },
 
     ns:: error "ns needs to be a kube.Namespace object",
+    local ns = app.ns,
 
     config:: {
         repo: {
@@ -60,13 +61,13 @@
         ],
     },
 
-    configSecret: app.ns.Contain(kube.Secret("media-repo-config")) {
+    configSecret: ns.Contain(kube.Secret("media-repo-config")) {
         data_: {
             "config.yaml": std.manifestJsonEx(app.config, ""),
         },
     },
 
-    deployment: app.ns.Contain(kube.Deployment("media-repo")) {
+    deployment: ns.Contain(kube.Deployment("media-repo")) {
         spec+: {
             replicas: 1,
             template+: {
@@ -132,7 +133,7 @@
         local prefix = "https://",
         local downstreamHost = std.substr(homeserver.csApi, std.length(prefix), std.length(homeserver.csApi)-std.length(prefix)),
 
-        deployment: app.ns.Contain(kube.Deployment("media-repo-proxy")) {
+        deployment: ns.Contain(kube.Deployment("media-repo-proxy")) {
             spec+: {
                 template+: {
                     spec+: {
@@ -157,11 +158,11 @@
         },
     } else {},
 
-    internalSvc: app.ns.Contain(kube.Service("media-repo-internal")) {
+    internalSvc: ns.Contain(kube.Service("media-repo-internal")) {
         target:: app.deployment,
     },
 
-    svc: if std.length(needProxying) > 0 then app.ns.Contain(kube.Service("media-repo")) {
+    svc: if std.length(needProxying) > 0 then ns.Contain(kube.Service("media-repo")) {
         target:: app.proxies.deployment,
     } else app.internalSvc,
 }
diff --git a/app/matrix/lib/riot.libsonnet b/app/matrix/lib/riot.libsonnet
index 23273f9..3d0dbdf 100644
--- a/app/matrix/lib/riot.libsonnet
+++ b/app/matrix/lib/riot.libsonnet
@@ -12,6 +12,7 @@
     },
 
     ns:: error "ns needs to be a kube.Namespace object",
+    local ns = app.ns,
 
     config:: {
         "default_hs_url": "https://%s" % [cfg.webDomain],
@@ -43,7 +44,7 @@
         }
     },
 
-    configMap: app.ns.Contain(kube.ConfigMap("riot-web-config")) {
+    configMap: ns.Contain(kube.ConfigMap("riot-web-config")) {
         data: {
             "config.json": std.manifestJsonEx(app.config, ""),
             // Standard nginx.conf, made to work when running as unprivileged user.
@@ -51,7 +52,7 @@
         },
     },
 
-    deployment: app.ns.Contain(kube.Deployment("riot-web")) {
+    deployment: ns.Contain(kube.Deployment("riot-web")) {
         spec+: {
             replicas: 1,
             template+: {
@@ -89,7 +90,7 @@
         },
     },
 
-    svc: app.ns.Contain(kube.Service("riot-web")) {
+    svc: ns.Contain(kube.Service("riot-web")) {
         target:: app.deployment,
     },
 }
diff --git a/app/matrix/lib/synapse.libsonnet b/app/matrix/lib/synapse.libsonnet
index 07656da..c9a03e7 100644
--- a/app/matrix/lib/synapse.libsonnet
+++ b/app/matrix/lib/synapse.libsonnet
@@ -24,13 +24,14 @@
     },
 
     ns:: error "ns needs to be provided",
+    local ns = app.ns,
     postgres:: error "postgres needs to be provided",
     redis:: error "redis needs to be provided",
 
     // See matrix-ng.libsonnet for description
     appservices:: error "appservices need to be provided",
 
-    dataVolume: app.ns.Contain(kube.PersistentVolumeClaim("synapse-data-waw3")) {
+    dataVolume: ns.Contain(kube.PersistentVolumeClaim("synapse-data-waw3")) {
         storage:: "50Gi",
         storageClass:: cfg.storageClassName,
     },
@@ -71,7 +72,7 @@
         turn_allow_guests: true,
     } else {}),
 
-    configMap: app.ns.Contain(kube.ConfigMap("synapse")) {
+    configMap: ns.Contain(kube.ConfigMap("synapse")) {
         data: {
             "homeserver.yaml": std.manifestYamlDoc(app.config),
             "log.config": importstr "synapse/log.config",
@@ -92,7 +93,7 @@
     } else {}),
 
     # Synapse process Deployment/StatefulSet base resource.
-    SynapseWorker(name, workerType, builder):: app.ns.Contain(builder(name)) {
+    SynapseWorker(name, workerType, builder):: ns.Contain(builder(name)) {
         local worker = self,
         cfg:: {
             # Configuration customization. Can contain environment substitution
@@ -229,10 +230,10 @@
                 },
             },
         },
-        svc: app.ns.Contain(kube.Service("synapse")) {
+        svc: ns.Contain(kube.Service("synapse")) {
             target:: app.main.deployment,
         },
-        replicationSvc: app.ns.Contain(kube.Service("synapse-replication-master")) {
+        replicationSvc: ns.Contain(kube.Service("synapse-replication-master")) {
             target:: app.main.deployment,
             spec+: {
                 ports: [
@@ -261,7 +262,7 @@
                 },
             },
         },
-        svc: app.ns.Contain(kube.Service("synapse-generic")) {
+        svc: ns.Contain(kube.Service("synapse-generic")) {
             target:: app.genericWorker.deployment,
         },
 
@@ -385,7 +386,7 @@
                 },
             },
         },
-        svc: app.ns.Contain(kube.Service("synapse-media")) {
+        svc: ns.Contain(kube.Service("synapse-media")) {
             target:: app.mediaWorker.deployment,
         },
     },
diff --git a/app/matrix/lib/wellknown.libsonnet b/app/matrix/lib/wellknown.libsonnet
index 509b83c..1760e01 100644
--- a/app/matrix/lib/wellknown.libsonnet
+++ b/app/matrix/lib/wellknown.libsonnet
@@ -11,8 +11,9 @@
     },
 
     ns:: error "ns needs to be a kube.Namespace object",
+    local ns = app.ns,
 
-    deployment: app.ns.Contain(kube.Deployment("wellknown")) {
+    deployment: ns.Contain(kube.Deployment("wellknown")) {
         spec+: {
             replicas: 1,
             template+: {
@@ -35,7 +36,7 @@
             },
         },
     },
-    svc: app.ns.Contain(kube.Service("wellknown")) {
+    svc: ns.Contain(kube.Service("wellknown")) {
         target:: app.deployment,
     },
 }