diff --git a/.taskfiles/k8s/Taskfile.dist.yaml b/.taskfiles/k8s/Taskfile.dist.yaml
index 75366bd1..75451de8 100644
--- a/.taskfiles/k8s/Taskfile.dist.yaml
+++ b/.taskfiles/k8s/Taskfile.dist.yaml
@@ -132,11 +132,12 @@ tasks:
       - cp -r ./kube/templates/test ./kube/deploy/apps/{{.APP}}
       # lowercase, used for resource names etc
       - grep -lR 'APPNAME' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/${APPNAME}/{{.APP}}/g' %
-      - grep -lR 'IMAGENAME' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/${IMAGENAME}/{{.IMAGENAME}}/g' %
-      - grep -lR 'IMAGETAG' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/${IMAGETAG}/{{.IMAGETAG}}/g' %
+      - grep -lR 'IMAGENAME' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/${IMAGENAME}/{{.IMAGENAME | replace "/" "\\/"}}/g' %
+      - grep -lR 'IMAGETAG' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/${IMAGETAG}/{{.IMAGETAG | replace "/" "\\/"}}/g' %
       # uppercase, for variable substitution references e.g. ${APP_DNS_AUTHENTIK}
       - grep -lR 'APPNAME' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/_APPNAME:=/_{{.APP}}:=/g;s/\(_{{.APP}}:=\)/\U\1/g' %
       - grep -lR 'APPNAME' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/_APPNAME}/_{{.APP}}}/g;s/\(_{{.APP}}}\)/\U\1/g' %
+      - grep -lR 'APPNAME' ./kube/deploy/apps/{{.APP}}/ | xargs -I% sed -i 's/_APPNAME }}/_{{.APP}}}/g;s/\(_{{.APP}} }}\)/\U\1/g' %
 
   shortnames:
     desc: List all installed CRDs and their short names.
diff --git a/kube/deploy/apps/strfry/app/hr.yaml b/kube/deploy/apps/strfry/app/hr.yaml
index 47160d62..0f2c0204 100644
--- a/kube/deploy/apps/strfry/app/hr.yaml
+++ b/kube/deploy/apps/strfry/app/hr.yaml
@@ -23,7 +23,7 @@ spec:
         strategy: RollingUpdate
         pod:
           labels:
-            ingress.home.arpa/nginx-internal: allow
+            ingress.home.arpa/nginx-public: allow
             egress.home.arpa/internet: allow
         containers:
           app: