diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7892c38..6668761 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,8 +29,25 @@ jobs:
         run: |
           GITLEAKS_VERSION=$(curl -sf https://api.github.com/repos/gitleaks/gitleaks/releases/latest \
             | grep '"tag_name"' | cut -d'"' -f4)
-          curl -sfL "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz" \
-            | tar -xz -C /usr/local/bin gitleaks
+          if [[ -z "$GITLEAKS_VERSION" ]]; then
+            echo "ERROR: failed to resolve gitleaks version" >&2
+            exit 1
+          fi
+
+          archive="$(mktemp)"
+          trap 'rm -f "$archive"' EXIT
+          url="https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz"
+          for attempt in 1 2 3; do
+            if curl -sfL "$url" -o "$archive" && tar -tzf "$archive" >/dev/null 2>&1; then
+              tar -xzf "$archive" -C /usr/local/bin gitleaks
+              exit 0
+            fi
+            echo "Gitleaks archive download was incomplete (attempt ${attempt}/3)" >&2
+            rm -f "$archive"
+            sleep "$attempt"
+          done
+          echo "ERROR: failed to download a valid gitleaks archive" >&2
+          exit 1
       - name: Detect secrets
         run: gitleaks detect --config .gitleaks.toml --source . --redact
 
diff --git a/clusters/oci-lab/apps/harbor-backup/manifests/cronjob.yaml b/clusters/oci-lab/apps/harbor-backup/manifests/cronjob.yaml
index fb40ea1..2f47e91 100644
--- a/clusters/oci-lab/apps/harbor-backup/manifests/cronjob.yaml
+++ b/clusters/oci-lab/apps/harbor-backup/manifests/cronjob.yaml
@@ -28,13 +28,13 @@ spec:
               image: postgres:16-alpine
               env:
                 - name: PGHOST
-                  value: harbor-database
+                  value: oci-lab-harbor-database
                 - name: PGUSER
                   value: postgres
                 - name: PGPASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: harbor-database
+                      name: oci-lab-harbor-database
                       key: POSTGRES_PASSWORD
               command: [sh, -ceu]
               args:
diff --git a/values/clusters/oci-lab/harbor.yaml b/values/clusters/oci-lab/harbor.yaml
index c6370f9..efa12bc 100644
--- a/values/clusters/oci-lab/harbor.yaml
+++ b/values/clusters/oci-lab/harbor.yaml
@@ -60,13 +60,13 @@ core:
       imagePullPolicy: IfNotPresent
       env:
         - name: PGHOST
-          value: harbor-database
+          value: oci-lab-harbor-database
         - name: PGUSER
           value: postgres
         - name: PGPASSWORD
           valueFrom:
             secretKeyRef:
-              name: harbor-database
+              name: oci-lab-harbor-database
               key: POSTGRES_PASSWORD
         - name: AWS_ACCESS_KEY_ID
           valueFrom: