diff --git a/templates/opt/gitea/home/app.ini.j2 b/templates/opt/gitea/home/app.ini.j2
index e2118d2..fa2953c 100755
--- a/templates/opt/gitea/home/app.ini.j2
+++ b/templates/opt/gitea/home/app.ini.j2
@@ -1,6 +1,8 @@
 APP_NAME = gitea@{{ gitea_ssh_domain }}
 RUN_USER = {{ gitea_usr }}
 RUN_MODE = {{ cloud_stage }}
+# set explicitly, otherwise Gitea writes it back and reformats this file on every start
+WORK_PATH = {{ gitea_data_location }}
 
 [database]
 DB_TYPE  = {{ gitea_dbtype_mapping[gitea_db.type] | default('mysql') }}
@@ -62,6 +64,11 @@ NO_REPLY_ADDRESS                  = noreply.{{ gitea_ssh_domain }}
 ENABLE_OPENID_SIGNIN = false
 ENABLE_OPENID_SIGNUP = false
 
+{% if gitea_oauth2_jwt_secret is defined %}
+[oauth2]
+JWT_SECRET = {{ gitea_oauth2_jwt_secret }}
+
+{% endif %}
 [oauth2_client]
 ENABLE_AUTO_REGISTRATION = true
 UPDATE_AVATAR            = true