diff --git a/apps/nextcloud/templates/deployment.yaml b/apps/nextcloud/templates/deployment.yaml
index d9a15cf..fc3069d 100644
--- a/apps/nextcloud/templates/deployment.yaml
+++ b/apps/nextcloud/templates/deployment.yaml
@@ -21,7 +21,7 @@ spec:
           envFrom:
           - secretRef:
               name: {{ tpl .Values.identifier . }}-postgres-config
-          # Use subpath to avoid lost+found error
+
           volumeMounts:
             - name: postgres-data
               mountPath: "/var/lib/postgresql/data"
@@ -58,7 +58,6 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-nextcloud
-        use-as-service: {{ .Release.Name }}
     spec:
       initContainers:
         - name: wait-for-cert
@@ -70,8 +69,18 @@ spec:
           volumeMounts:
             - name: etcletsencrypt
               mountPath: "/etc/letsencrypt"
+        - name: copy-php
+          image: nextcloud:20-fpm
+          command:
+            - rsync
+            - -a
+            - -v
+            - /var/www/html/
+            - /var/www/nextcloud
+          volumeMounts:
+            - name: nextcloud-php
+              mountPath: "/var/www/nextcloud"
       containers:
-        # This container will only start *after* the cert has been placed
         - name: nginx
           image: nginx:1.21-alpine
           ports:
@@ -81,24 +90,26 @@ spec:
               mountPath: "/etc/nginx/conf.d/"
             - name: etcletsencrypt
               mountPath: "/etc/letsencrypt"
+            - name: nextcloud-php
+              mountPath: "/var/www/nextcloud"
         - name: nextcloud
-          image: nextcloud/nextcloud:{{ .Chart.AppVersion }}
+          image: nextcloud:20-fpm
           ports:
             - containerPort: 9000
           env:
             - name: POSTGRES_DB
               valueFrom:
-                secretRef:
+                secretKeyRef:
                   name: {{ tpl .Values.identifier . }}-postgres-config
                   key: POSTGRES_DB
             - name: POSTGRES_USER
               valueFrom:
-                secretRef:
+                secretKeyRef:
                   name: {{ tpl .Values.identifier . }}-postgres-config
                   key: POSTGRES_USER
             - name: POSTGRES_PASSWORD
               valueFrom:
-                secretRef:
+                secretKeyRef:
                   name: {{ tpl .Values.identifier . }}-postgres-config
                   key: POSTGRES_PASSWORD
             - name: POSTGRES_HOST
@@ -106,10 +117,10 @@ spec:
             - name: NEXTCLOUD_DATA_DIR
               value: "/data"
           volumeMounts:
-            - name: etcletsencrypt
-              mountPath: "/etc/letsencrypt"
             - name: data
               mountPath: "/data"
+            - name: nextcloud-php
+              mountPath: "/var/www/nextcloud"
       volumes:
         - name: etcletsencrypt
           persistentVolumeClaim:
@@ -123,7 +134,8 @@ spec:
         - name: nginx-config
           configMap:
             name: {{ tpl .Values.identifier . }}-nginx-config
-
+        - name: nextcloud-php
+          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service
@@ -142,14 +154,7 @@ spec:
    - port: 443
      name: https
   selector:
-   use-as-service: {{ .Release.Name }}
-# ---
-# apiVersion: v1
-# kind: ConfigMap
-# metadata:
-#   name: {{ tpl .Values.identifier . }}-nextcloudconfig
-# data:
-# {{ tpl (.Files.Glob "nextcloud/*").AsConfig . | indent 2 }}
+   app: {{ .Release.Name }}-nextcloud
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -195,8 +200,7 @@ spec:
   template:
     metadata:
       labels:
-        app: certbot-letsencrypt-getcert
-        use-as-service: {{ .Release.Name }}
+        app: {{ .Release.Name }}-nextcloud
     spec:
       restartPolicy: Never
       containers: