diff --git a/apps/appsets/argocd/appset-argocd.yaml b/apps/appsets/argocd/appset-argocd.yaml
index ac0b62126..989bb5b2d 100644
--- a/apps/appsets/argocd/appset-argocd.yaml
+++ b/apps/appsets/argocd/appset-argocd.yaml
@@ -17,6 +17,9 @@ spec:
   template:
     metadata:
       name: '{{.name}}-argocd'
+      annotations:
+        # we want ArgoCD itself to sync as early as possible
+        argocd.argoproj.io/sync-wave: "-1000"
     spec:
       project: default
       sources:
diff --git a/bootstrap/argocd/values.yaml b/bootstrap/argocd/values.yaml
index 932c1cc48..8fc50382b 100644
--- a/bootstrap/argocd/values.yaml
+++ b/bootstrap/argocd/values.yaml
@@ -20,13 +20,6 @@ configs:
     server.insecure: true
   cm:
     kustomize.buildOptions: --enable-helm --load-restrictor LoadRestrictionsNone
-    resource.exclusions: |
-        - apiGroups:
-          - cilium.io
-          kinds:
-          - CiliumIdentity
-          clusters:
-          - "*"
   rbac:
     policy.csv: |
       # role:ucadmin can sync applications