diff --git a/k8s/infra/rbac/admin-oidc-binding.yaml b/k8s/infra/rbac/admin-oidc-binding.yaml
index 63b0de2..b29c9a1 100644
--- a/k8s/infra/rbac/admin-oidc-binding.yaml
+++ b/k8s/infra/rbac/admin-oidc-binding.yaml
@@ -2,15 +2,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: homelab-admin-oidc
-spec:
-  roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: ClusterRole
-    name: cluster-admin
-  subjects:
-    # OIDC group for Authentik homelab-admins members
-    # When rock logs in via OIDC, k8s sees:
-    # - User: oidc:rock@example.com
-    # - Groups: oidc:homelab-admins (from Authentik group claim)
-    - kind: Group
-      name: oidc:homelab-admins
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  # OIDC group for Authentik homelab-admins members
+  # When rock logs in via OIDC, k8s sees:
+  # - User: oidc:rock@example.com
+  # - Groups: oidc:homelab-admins (from Authentik group claim)
+  - kind: Group
+    name: oidc:homelab-admins