diff --git a/infrastructure/zitadel/contour-template/zitadel.yaml b/infrastructure/zitadel/contour-template/zitadel.yaml
index ba42a20..fe8dbd1 100644
--- a/infrastructure/zitadel/contour-template/zitadel.yaml
+++ b/infrastructure/zitadel/contour-template/zitadel.yaml
@@ -110,6 +110,17 @@ spec:
       configmapConfig:
         ExternalDomain: ${HOST_LOGIN}
         ExternalSecure: true
+        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
+        # in secret zitadel/sarex-installer. Created only on the first instance setup.
+        FirstInstance:
+          Org:
+            Machine:
+              Machine:
+                Username: sarex-installer
+                Name: sarexctl
+              MachineKey:
+                ExpirationDate: "2099-01-01T00:00:00Z"
+                Type: 1
       debug:
         enabled: false
     postgresqlSecret: