diff --git a/playbooks/deploy-eom.yml b/playbooks/deploy-eom.yml
index 7ba3968..23a0747 100755
--- a/playbooks/deploy-eom.yml
+++ b/playbooks/deploy-eom.yml
@@ -2,9 +2,10 @@
 # Run on the controller with its existing kubeconfig; no SSH target is required.
 # Supply credentials via inventory/group_vars or a Vault-encrypted vars file.
 - name: Deploy eom.dev Dex with Catppuccin branding
-  hosts: localhost
-  connection: local
-  gather_facts: false
+  hosts: alpha-control-plane
+  vars_files:
+    ../secrets.yaml
+  become: true
   vars:
     dex_namespace: dex
     dex_release_name: dex