diff --git a/src/main/helm/templates/_helpers.tpl b/src/main/helm/templates/_helpers.tpl
index 7e9ba5ec246612665885103a23d9968a2aed954a..95cbd1ab2dc40644d5831806da452e5992c99085 100644
--- a/src/main/helm/templates/_helpers.tpl
+++ b/src/main/helm/templates/_helpers.tpl
@@ -60,20 +60,12 @@ app.kubernetes.io/namespace: {{ include "app.namespace" . }}
 {{- end -}}
 
 {{- define "app.ssoClientName" -}}
-{{- if (.Values.sso).keycloak_clients -}}
-{{- if (first .Values.sso.keycloak_clients).client_name -}}
-{{ printf "%s" (first .Values.sso.keycloak_clients).client_name }}
+{{- if (.Values.sso.keycloak_client).client_name -}}
+{{ printf "%s" (.Values.sso.keycloak_client).client_name }}
 {{- else -}}
-{{ include "app.defaultSsoClientName" . }}
-{{- end -}}
-{{- else -}}
-{{ include "app.defaultSsoClientName" . }}
-{{- end -}}
-{{- end -}}
-
-{{- define "app.defaultSsoClientName" -}}
 {{ printf "admin" }}
 {{- end -}}
+{{- end -}}
 
 {{- define "app.ssoServerUrl" -}}
 {{- required "sso.serverUrl muss angegeben sein" (.Values.sso).serverUrl -}}
diff --git a/src/main/helm/templates/keycloak_client_crd.yaml b/src/main/helm/templates/keycloak_client_crd.yaml
index 12c71b9e5c138ca1fc0d83f38074b52d49310a8a..2aac793289643ccddb7d26d885731fd0a901a93a 100644
--- a/src/main/helm/templates/keycloak_client_crd.yaml
+++ b/src/main/helm/templates/keycloak_client_crd.yaml
@@ -1,5 +1,5 @@
 {{- if not (.Values.sso).disableOzgOperator -}}
-{{ range $client := (.Values.sso).keycloak_clients }}
+{{ $client := (.Values.sso).keycloak_client }}
 ---
 apiVersion: operator.ozgcloud.de/v1
 kind: OzgCloudKeycloakClient
@@ -9,7 +9,7 @@ metadata:
 spec:
   keep_after_delete: {{ $.Values.sso.keep_after_delete | default false }}
   client_name: {{ $client.client_name }}
-  client_base_url: https://{{ include "app.baseDomain" $ }}  
+  client_base_url: https://{{ include "app.baseDomain" $ }}
 
   client_web_origins:
     - https://{{ include "app.baseDomain" $ }}
@@ -32,5 +32,4 @@ spec:
 {{ toYaml . | indent 4 }}
     {{- end }}
   {{- end }}
-{{ end }}
 {{- end -}}
\ No newline at end of file
diff --git a/src/test/helm/deployment_defaults_sso_test.yaml b/src/test/helm/deployment_defaults_sso_test.yaml
index 53f533fdf262c911b2ef10c081323d8de69b1ef1..3af4ab3385e69bae001433ba9cf8b0df3795ce9b 100644
--- a/src/test/helm/deployment_defaults_sso_test.yaml
+++ b/src/test/helm/deployment_defaults_sso_test.yaml
@@ -75,8 +75,8 @@ tests:
   - it: check different client name
     set:
       sso:
-        keycloak_clients:
-          - client_name: different-client
+        keycloak_client:
+          client_name: different-client
     asserts:
       - isKind:
           of: Deployment
@@ -85,17 +85,3 @@ tests:
           content:
             name: ozgcloud_oauth2_resource
             value: different-client
-
-  - it: should have default client name
-    set:
-      sso:
-        keycloak_clients:
-          - client_name_typo: different-client
-    asserts:
-      - isKind:
-          of: Deployment
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: ozgcloud_oauth2_resource
-            value: admin
diff --git a/src/test/helm/keycloak_client_crd_test.yaml b/src/test/helm/keycloak_client_crd_test.yaml
index 47e90d4d0dd42abd6bd85d67ad1b223d2eed5abe..bb199c30c8003e7b5bf3b1b8329633a687a85277 100644
--- a/src/test/helm/keycloak_client_crd_test.yaml
+++ b/src/test/helm/keycloak_client_crd_test.yaml
@@ -37,8 +37,8 @@ tests:
   - it: should contain header data
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - isAPIVersion:
           of: operator.ozgcloud.de/v1
@@ -47,8 +47,8 @@ tests:
   - it: should have metadata
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: metadata.name
@@ -59,8 +59,8 @@ tests:
   - it: should set keep after delete default to false
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.keep_after_delete
@@ -69,8 +69,8 @@ tests:
     set:
       sso:
         keep_after_delete: true
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.keep_after_delete
@@ -78,8 +78,8 @@ tests:
   - it: has client name value
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_name
@@ -87,8 +87,8 @@ tests:
   - it: should set client base url
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_base_url
@@ -96,8 +96,8 @@ tests:
   - it: should set client redirect uris
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_web_origins
@@ -106,8 +106,8 @@ tests:
   - it: should set client web origins
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_redirect_uris
@@ -117,11 +117,11 @@ tests:
   - it: should use additional client web origins
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
-            additional_client_web_origins:
-              - https://some.origin.de
-              - https://some.other.origin.de
+        keycloak_client:
+          client_name: admin
+          additional_client_web_origins:
+            - https://some.origin.de
+            - https://some.other.origin.de
     asserts:
       - equal:
           path: spec.client_web_origins
@@ -132,10 +132,10 @@ tests:
   - it: should use additional redirect uris for client web origins
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
-            additional_redirect_uris:
-              - https://additional.url.de
+        keycloak_client:
+          client_name: admin
+          additional_redirect_uris:
+            - https://additional.url.de
     asserts:
       - equal:
           path: spec.client_redirect_uris
@@ -146,8 +146,8 @@ tests:
   - it: should not create client cr if ozg operator is disabled
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
         disableOzgOperator: true
     asserts:
       - hasDocuments: