diff --git a/app/matrix/lib/matrix-ng.libsonnet b/app/matrix/lib/matrix-ng.libsonnet
index 976b8b5..5c0ef2a 100644
--- a/app/matrix/lib/matrix-ng.libsonnet
+++ b/app/matrix/lib/matrix-ng.libsonnet
@@ -23,6 +23,11 @@
 #    .riotConfig → .riot.config
 #    .synapseConfig → .synapse.config
 #
+# When migrating from CAS to OpenID Connect authentication scheme following need
+# to be ensured:
+#  * https://{homeserver}/_synapse/oidc/callback is added to allowed callback URLs list
+#  * openid scope is enabled for configured client
+#
 # Sequencing appservices is fun. The appservice needs to run first (for
 # instance, via a bootstrap job), and on startup it will spit out a
 # registration file.  This registration file then needs to be fed to synapse -
@@ -117,6 +122,17 @@
         wellKnown: false,
     },
 
+    # DEPRECATED: this needs to be removed in favor of namespace.Contain() in
+    # modules that depend on this (appservices/instance defintions)
+    metadata(component):: {
+        namespace: cfg.namespace,
+        labels: {
+            "app.kubernetes.io/name": "matrix",
+            "app.kubernetes.io/managed-by": "kubecfg",
+            "app.kubernetes.io/component": component,
+        },
+    },
+
     namespace: kube.Namespace(cfg.namespace),
 
     postgres3: postgres {