diff --git a/src/main/helm/templates/_helpers.tpl b/src/main/helm/templates/_helpers.tpl
index e6d9c8ad3c0c651c342697ccc99a741a46791248..95cbd1ab2dc40644d5831806da452e5992c99085 100644
--- a/src/main/helm/templates/_helpers.tpl
+++ b/src/main/helm/templates/_helpers.tpl
@@ -60,10 +60,10 @@ app.kubernetes.io/namespace: {{ include "app.namespace" . }}
 {{- end -}}
 
 {{- define "app.ssoClientName" -}}
-{{- if (.Values.sso).client_name -}}
-{{ printf "%s" (.Values.sso).client_name }}
+{{- if (.Values.sso.keycloak_client).client_name -}}
+{{ printf "%s" (.Values.sso.keycloak_client).client_name }}
 {{- else -}}
-{{ printf "administration" }}
+{{ printf "admin" }}
 {{- end -}}
 {{- end -}}
 
diff --git a/src/main/helm/templates/keycloak_client_crd.yaml b/src/main/helm/templates/keycloak_client_crd.yaml
index 12c71b9e5c138ca1fc0d83f38074b52d49310a8a..2aac793289643ccddb7d26d885731fd0a901a93a 100644
--- a/src/main/helm/templates/keycloak_client_crd.yaml
+++ b/src/main/helm/templates/keycloak_client_crd.yaml
@@ -1,5 +1,5 @@
 {{- if not (.Values.sso).disableOzgOperator -}}
-{{ range $client := (.Values.sso).keycloak_clients }}
+{{ $client := (.Values.sso).keycloak_client }}
 ---
 apiVersion: operator.ozgcloud.de/v1
 kind: OzgCloudKeycloakClient
@@ -9,7 +9,7 @@ metadata:
 spec:
   keep_after_delete: {{ $.Values.sso.keep_after_delete | default false }}
   client_name: {{ $client.client_name }}
-  client_base_url: https://{{ include "app.baseDomain" $ }}  
+  client_base_url: https://{{ include "app.baseDomain" $ }}
 
   client_web_origins:
     - https://{{ include "app.baseDomain" $ }}
@@ -32,5 +32,4 @@ spec:
 {{ toYaml . | indent 4 }}
     {{- end }}
   {{- end }}
-{{ end }}
 {{- end -}}
\ No newline at end of file
diff --git a/src/test/helm/deployment_defaults_sso_test.yaml b/src/test/helm/deployment_defaults_sso_test.yaml
index 70a0cac25bae20872a5556b66f68021159f391cb..3af4ab3385e69bae001433ba9cf8b0df3795ce9b 100644
--- a/src/test/helm/deployment_defaults_sso_test.yaml
+++ b/src/test/helm/deployment_defaults_sso_test.yaml
@@ -50,7 +50,7 @@ tests:
           path: spec.template.spec.containers[0].env
           content:
             name: ozgcloud_oauth2_resource
-            value: administration
+            value: admin
       - contains:
           path: spec.template.spec.containers[0].env
           content:
@@ -63,8 +63,6 @@ tests:
         bezeichner: eins-zwei-drei
         environment: dev
         bundesland: sh
-      sso:
-        serverUrl: https://sso.company.local
     asserts:
       - isKind:
           of: Deployment
@@ -77,8 +75,8 @@ tests:
   - it: check different client name
     set:
       sso:
-        client_name: different-client
-        serverUrl: https://sso.company.local
+        keycloak_client:
+          client_name: different-client
     asserts:
       - isKind:
           of: Deployment
diff --git a/src/test/helm/keycloak_client_crd_test.yaml b/src/test/helm/keycloak_client_crd_test.yaml
index 47e90d4d0dd42abd6bd85d67ad1b223d2eed5abe..bb199c30c8003e7b5bf3b1b8329633a687a85277 100644
--- a/src/test/helm/keycloak_client_crd_test.yaml
+++ b/src/test/helm/keycloak_client_crd_test.yaml
@@ -37,8 +37,8 @@ tests:
   - it: should contain header data
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - isAPIVersion:
           of: operator.ozgcloud.de/v1
@@ -47,8 +47,8 @@ tests:
   - it: should have metadata
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: metadata.name
@@ -59,8 +59,8 @@ tests:
   - it: should set keep after delete default to false
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.keep_after_delete
@@ -69,8 +69,8 @@ tests:
     set:
       sso:
         keep_after_delete: true
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.keep_after_delete
@@ -78,8 +78,8 @@ tests:
   - it: has client name value
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_name
@@ -87,8 +87,8 @@ tests:
   - it: should set client base url
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_base_url
@@ -96,8 +96,8 @@ tests:
   - it: should set client redirect uris
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_web_origins
@@ -106,8 +106,8 @@ tests:
   - it: should set client web origins
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
     asserts:
       - equal:
           path: spec.client_redirect_uris
@@ -117,11 +117,11 @@ tests:
   - it: should use additional client web origins
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
-            additional_client_web_origins:
-              - https://some.origin.de
-              - https://some.other.origin.de
+        keycloak_client:
+          client_name: admin
+          additional_client_web_origins:
+            - https://some.origin.de
+            - https://some.other.origin.de
     asserts:
       - equal:
           path: spec.client_web_origins
@@ -132,10 +132,10 @@ tests:
   - it: should use additional redirect uris for client web origins
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
-            additional_redirect_uris:
-              - https://additional.url.de
+        keycloak_client:
+          client_name: admin
+          additional_redirect_uris:
+            - https://additional.url.de
     asserts:
       - equal:
           path: spec.client_redirect_uris
@@ -146,8 +146,8 @@ tests:
   - it: should not create client cr if ozg operator is disabled
     set:
       sso:
-        keycloak_clients:
-          - client_name: admin
+        keycloak_client:
+          client_name: admin
         disableOzgOperator: true
     asserts:
       - hasDocuments: