diff --git a/ci/outline/test-values.yaml b/ci/outline/test-values.yaml
index 42ca579..203cde7 100644
--- a/ci/outline/test-values.yaml
+++ b/ci/outline/test-values.yaml
@@ -1,6 +1,13 @@
 secrets:
   configSecretRef: op://ci/outline-config
   redisSecretRef: op://ci/outline-redis
+  dbSecretRef: op://ci/outline-db
+
+ingress:
+  domain: outline.ci.local
+  # clusterIssuer is strictly required (no default); the Ingress just has to
+  # apply - there is no cert-manager in the CI cluster.
+  clusterIssuer: ci
 
 # The egress cap of the chart's NetworkPolicy (Gitea #5) allows 443 for the
 # OIDC provider, because that is where an OIDC provider normally listens. The
@@ -18,10 +25,3 @@ networkPolicy:
   egress:
     extraPorts:
       - 5556
-  dbSecretRef: op://ci/outline-db
-
-ingress:
-  domain: outline.ci.local
-  # clusterIssuer is strictly required (no default); the Ingress just has to
-  # apply - there is no cert-manager in the CI cluster.
-  clusterIssuer: ci