diff --git a/Makefile b/Makefile
index 832af432..9f4965d7 100644
--- a/Makefile
+++ b/Makefile
@@ -49,6 +49,7 @@ check-vars:
 	@test -f "$(GITHUBHAPP_PRIVATE_KEY_FILE_PATH)" || (echo "Error: GITHUBHAPP_PRIVATE_KEY_FILE_PATH file '$(GITHUBHAPP_PRIVATE_KEY_FILE_PATH)' not found. Create the file before installing" && exit 1)
 	@test -n "$(GITHUBHAPP_PRIVATE_KEY_VAULT_PATH)" || (echo "Error: GITHUBHAPP_PRIVATE_KEY_VAULT_PATH is undefined. Run 'export GITHUBHAPP_PRIVATE_KEY_VAULT_PATH=...' before installing" && exit 1)
 	@test -n "$(GITHUBHAPP_INSTALLATION_ID)" || (echo "Error: GITHUBHAPP_INSTALLATION_ID is undefined. Run 'export GITHUBHAPP_INSTALLATION_ID=...' before installing" && exit 1)
+	@test -n "$(GITHUBHAPP_CALLBACK_FLASK_KEY)" || (echo "Error: GITHUBHAPP_CALLBACK_FLASK_KEY is undefined. Run 'export GITHUBHAPP_CALLBACK_FLASK_KEY=...' before installing" && exit 1)
 	@echo "✅ All GITHUBHAPP environment variables are set."
 
 
@@ -205,6 +206,9 @@ argo-stack:
 		--set githubStatusProxy.privateKeySecret.name="${GITHUBHAPP_PRIVATE_KEY_SECRET_NAME}" \
 		--set githubStatusProxy.privateKeySecret.key=privateKey \
 		--set githubStatusProxy.logLevel="DEBUG" \
+		--set-string gitappCallback.githubRepoUrl=https://github.com/calypr/registrations-test \
+		--set-string gitappCallback.githubUserName=bwalsh \
+		--set-string gitappCallback.secretKey="${GITHUBHAPP_CALLBACK_FLASK_KEY}"\
 		-f helm/argo-stack/admin-values.yaml \
 		-f -
 
@@ -225,6 +229,10 @@ ports:
 	kubectl create secret tls ${TLS_SECRET_NAME}  -n calypr-api     --cert=/tmp/fullchain.pem --key=/tmp/privkey.pem || true
 	kubectl create secret tls ${TLS_SECRET_NAME}  -n calypr-tenants --cert=/tmp/fullchain.pem --key=/tmp/privkey.pem || true
 	sudo rm /tmp/fullchain.pem /tmp/privkey.pem
+	#
+	kubectl create secret generic gitapp-vault-token \
+  		--from-literal=token=$(VAULT_TOKEN) \
+  		-n argocd
 	# install ingress
 	helm upgrade --install ingress-authz-overlay \
 	  helm/argo-stack/overlays/ingress-authz-overlay \
diff --git a/docs/adr/0006-ux-secrets-mgt-on-registration.md b/docs/adr/0006-ux-secrets-mgt-on-registration.md
new file mode 100644
index 00000000..210042f3
--- /dev/null
+++ b/docs/adr/0006-ux-secrets-mgt-on-registration.md
@@ -0,0 +1,448 @@
+
+# ADR-00X: UI Handling of Secrets on CREATE and UPDATE
+
+**Status:** Accepted
+**Date:** 2025-01-XX
+**Decision Makers:** Platform, Security, UX
+**Context:** Web UI, API-backed resources, GitOps-managed systems
+
+---
+
+## Context
+
+The platform requires users to provide **secrets** (e.g., API keys, client secrets, tokens) through a user interface during resource creation (**CREATE**) and later management (**UPDATE**).
+
+Secrets are highly sensitive and must be handled in a way that:
+
+* Minimizes exposure
+* Prevents accidental disclosure
+* Avoids unintended secret rotation
+* Aligns with industry-standard security and UX practices
+
+This ADR defines how secrets are collected, stored, and managed via the UI.
+
+---
+
+## Problem Statement
+
+How should secrets entered during **CREATE** be handled during **UPDATE**?
+
+Specifically:
+
+* Should secrets be re-displayed (masked or otherwise)?
+* Should users be required to re-enter secrets during UPDATE?
+* How should secret rotation be performed safely and intentionally?
+
+---
+
+## Decision
+
+### 1. Secrets Are Write-Only from the UI
+
+Once submitted, secrets:
+
+* **MUST NOT be re-displayed** in the UI
+* **MUST NOT be pre-filled** on UPDATE
+* **MUST NOT be retrievable** via the UI or API
+
+The UI treats secrets as **write-only values**.
+
+---
+
+### 2. CREATE Behavior
+
+On CREATE:
+
+* Users explicitly enter the secret
+* The UI may provide:
+
+  * Client-side validation (length, format)
+  * Optional “show/hide while typing”
+* After submission:
+
+  * The plaintext secret is immediately discarded
+  * Only a secure backend representation is retained (e.g., Vault, KMS-encrypted storage)
+
+**Optional UX enhancement:**
+
+* One-time confirmation message:
+  *“This secret will not be shown again. Please store it securely.”*
+
+---
+
+### 3. UPDATE Behavior (Default)
+
+On UPDATE:
+
+* Secrets are **not shown**
+* Secret input fields are **not rendered**
+* The UI displays non-sensitive metadata only, such as:
+
+  * “Secret: Configured”
+  * “Last updated: <timestamp>”
+
+**No re-entry is required** unless the user explicitly chooses to change the secret.
+
+---
+
+### 4. Secret Rotation / Replacement
+
+Secret changes are performed via an **explicit user action**, such as:
+
+* “Replace secret”
+* “Rotate credentials”
+
+When invoked:
+
+* A new, empty secret input field is displayed
+* The user must re-enter the full secret from scratch
+* Submitting the form replaces the existing stored secret
+
+This action is intentional, auditable, and irreversible.
+
+---
+## Sequence Diagrams
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor U as User
+    participant UI as Web UI
+    participant API as Platform API
+    participant VAULT as Secret Store (Vault/KMS)
+    participant DB as Resource DB
+    participant AUDIT as Audit Log
+
+    rect rgb(235, 248, 255)
+    note over U,DB: CREATE (secret collected once, write-only)
+    U->>UI: Fill form (includes secret)
+    UI->>API: POST /resources {config, secret}
+    API->>VAULT: Store secret (encrypt/unwrap/wrap)
+    VAULT-->>API: secret_ref (write-only handle)
+    API->>DB: Persist resource {config, secret_ref}
+    API->>AUDIT: Record "resource_created" (no secret value)
+    API-->>UI: 201 Created (secret never returned)
+    UI-->>U: Success + "Secret will not be shown again"
+    end
+
+    rect rgb(237, 255, 237)
+    note over U,DB: UPDATE (no secret change,secret not re-displayed)
+    U->>UI: Open resource settings
+    UI->>API: GET /resources/{id}
+    API->>DB: Load resource {config, secret_ref}
+    DB-->>API: {config, secret_ref}
+    API-->>UI: {config, secret_configured=true, secret_last_updated_at}
+    UI-->>U: Show config + "Secret: Configured" (no field by default)
+    U->>UI: Edit config (non-secret)
+    UI->>API: PATCH /resources/{id} {config_changes}
+    API->>DB: Update config only
+    API->>AUDIT: Record "resource_updated" (no secret value)
+    API-->>UI: 200 OK
+    UI-->>U: Success
+    end
+
+    rect rgb(255, 245, 235)
+    note over U,DB: ROTATE / REPLACE SECRET (explicit action)
+    U->>UI: Click "Replace/Rotate secret"
+    UI-->>U: Show empty secret input + warning
+    U->>UI: Enter new secret
+    UI->>API: POST /resources/{id}/secret:rotate {new_secret}
+    API->>VAULT: Store new secret (new version / overwrite)
+    VAULT-->>API: new_secret_ref (or new version id)
+    API->>DB: Update resource secret_ref + secret_last_updated_at
+    API->>AUDIT: Record "secret_rotated" (no secret value)
+    API-->>UI: 200 OK (secret not returned)
+    UI-->>U: Success + "Secret updated"
+    end
+
+```
+---
+
+## Alternatives Considered
+
+### A. Re-display masked secrets on UPDATE
+
+**Rejected**
+
+* Implies secrets are retrievable
+* Creates false confidence
+* Encourages unsafe behavior (screenshots, copying)
+
+---
+
+### B. Always require secret re-entry on UPDATE
+
+**Rejected**
+
+* Increases friction
+* Causes accidental secret rotation
+* Leads to outages and misconfiguration
+
+---
+
+### C. Empty secret field on UPDATE with “leave blank to keep existing”
+
+**Partially acceptable, but not preferred**
+
+* Increases risk of accidental replacement
+* Ambiguous UX semantics
+* Allowed only in low-risk internal tooling
+
+---
+
+## Rationale
+
+This decision aligns with:
+
+* Principle of least exposure
+* Zero-trust UI assumptions
+* Industry standards (cloud providers, payment platforms, developer tooling)
+
+Security considerations:
+
+* UI surfaces are high-risk (logs, extensions, screenshots)
+* Secrets should be non-recoverable once stored
+* Rotation must be deliberate, not incidental
+
+UX considerations:
+
+* Reduces accidental outages
+* Sets clear user expectations
+* Improves trust through explicit, predictable behavior
+
+---
+
+## Consequences
+
+### Positive
+
+* Reduced secret leakage risk
+* Clear separation between configuration and rotation
+* Safer UPDATE workflows
+* Easier security audits
+
+### Trade-offs
+
+* Users cannot “recover” lost secrets
+* Requires clear UX copy and documentation
+* Slightly more UI complexity (explicit rotate action)
+
+---
+
+## Implementation Notes
+
+* Backend APIs must treat secret fields as **write-only**
+* Update handlers must distinguish between:
+
+  * “no secret change”
+  * “explicit secret replacement”
+* Audit logs should record:
+
+  * Secret creation
+  * Secret replacement
+  * Actor and timestamp (but never the value)
+
+---
+
+## UX Copy Guidelines (Normative)
+
+Recommended language:
+
+* “For security reasons, this secret is not visible after creation.”
+* “To change the secret, replace it below.”
+* “Secrets are write-only and cannot be recovered.”
+
+Avoid:
+
+* Masked secret placeholders
+* Copyable secret values
+* Inline secret editing without intent
+
+---
+
+## Related Decisions
+
+🚧 TODO: Create other ADRs as needed and link here.
+
+* ADR-00Y: Secure Secret Storage (Vault / KMS)
+* ADR-00Z: Audit Logging for Credential Changes
+
+---
+
+
+
+---
+Below is the **conventional UX + security guidance** most teams converge on for handling secrets in a UI, especially when secrets are collected at **CREATE** time and later managed via **UPDATE**.
+
+---
+
+## Core Principle
+
+**Secrets are write-only from the UI’s perspective.**
+Once collected, they should **never be re-displayed**—not even masked—on subsequent views or edits.
+
+This applies to:
+
+* API keys
+* Client secrets
+* Passwords
+* Private keys
+* Tokens
+* Webhook signing secrets
+
+---
+
+## On CREATE
+
+**What’s conventional:**
+
+* User enters the secret explicitly.
+* The UI may:
+
+  * Validate format (length, prefix, checksum)
+  * Offer “show / hide while typing”
+* After submit:
+
+  * The plaintext secret is immediately discarded by the UI
+  * Only a securely stored representation remains (vault, KMS-wrapped value, etc.)
+
+**Optional UX enhancements (safe):**
+
+* One-time “copy this now” confirmation screen
+* Explicit warning: *“This secret will not be shown again.”*
+
+---
+
+## On UPDATE
+
+### 🔐 Are secrets re-displayed?
+
+**No. Never.**
+
+Conventional wisdom is:
+
+* Secrets are **not re-displayed**
+* Secrets are **not pre-filled**
+* Secrets are **not retrievable**
+
+Even masked placeholders like `••••••••` are generally discouraged unless they are **clearly synthetic** (i.e., not implying reversibility).
+
+---
+
+### 🔁 Do secrets need to be re-entered?
+
+**Only if the user is changing them.**
+
+There are two accepted patterns:
+
+---
+
+## Pattern 1: Explicit “Rotate / Replace Secret” (Best Practice)
+
+**UI behavior:**
+
+* On UPDATE, the secret field is **absent**
+* Instead, show:
+
+  * “Secret: Configured”
+  * “Last updated: <timestamp>”
+* Provide a deliberate action:
+
+  * “Replace secret”
+  * “Rotate credentials”
+
+**If user chooses to replace:**
+
+* Reveal an empty secret input
+* Require full re-entry
+* Overwrite stored secret
+
+**Why this is preferred:**
+
+* Prevents accidental secret invalidation
+* Makes rotation intentional
+* Communicates immutability clearly
+
+This is the pattern used by:
+
+* GitHub
+* AWS
+* GCP
+* Stripe
+* HashiCorp Vault UIs
+
+---
+
+## Pattern 2: Optional Re-entry on Save (Acceptable, but Riskier)
+
+**UI behavior:**
+
+* Secret field appears empty on UPDATE
+* Label clearly indicates:
+
+  * “Leave blank to keep existing secret”
+* Backend logic:
+
+  * Empty → no change
+  * Non-empty → replace
+
+**Risks:**
+
+* Users accidentally paste whitespace or wrong value
+* Ambiguous save semantics
+* Easier to misconfigure
+
+This pattern is common in internal tools but less favored in security-sensitive systems.
+
+---
+
+## 🚫 Anti-Patterns (Avoid These)
+
+| Anti-Pattern                        | Why It’s Bad                  |
+| ----------------------------------- | ----------------------------- |
+| Re-displaying secret (even masked)  | Implies reversibility         |
+| Pre-filling secret field            | High risk of leakage          |
+| Auto-reusing secret on edit         | Breaks zero-trust assumptions |
+| “Edit secret inline” without intent | Easy to accidentally rotate   |
+| Copyable secret after creation      | Violates least exposure       |
+
+---
+
+## UX Language That Works Well
+
+Use **explicit, confidence-building copy**:
+
+* “For security reasons, this secret is not visible after creation.”
+* “To change the secret, replace it below.”
+* “Leaving this field empty will keep the existing secret.”
+* “Secrets are write-only and cannot be recovered.”
+
+This reduces support tickets and increases trust.
+
+---
+
+## Security Rationale (Why This Is the Norm)
+
+1. **UI is a high-risk surface**
+
+   * Screenshots, browser extensions, logs, shoulder-surfing
+2. **Secrets should be non-recoverable**
+
+   * If you can show it, you can leak it
+3. **Principle of least exposure**
+
+   * No value in showing a secret after initial confirmation
+4. **Rotation should be intentional**
+
+   * Accidental rotation causes outages
+
+---
+
+## Bottom Line
+
+**Conventional wisdom is clear and consistent:**
+
+* **Secrets are collected only at CREATE or explicit ROTATE**
+* **Secrets are never re-displayed on UPDATE**
+* **Secrets are re-entered from scratch only if the user chooses to change them**
+* **Default UPDATE does not require re-entry**
diff --git a/gitapp-callback/.dockerignore b/gitapp-callback/.dockerignore
new file mode 100644
index 00000000..f7275bbb
--- /dev/null
+++ b/gitapp-callback/.dockerignore
@@ -0,0 +1 @@
+venv/
diff --git a/gitapp-callback/.gitignore b/gitapp-callback/.gitignore
new file mode 100644
index 00000000..f7275bbb
--- /dev/null
+++ b/gitapp-callback/.gitignore
@@ -0,0 +1 @@
+venv/
diff --git a/gitapp-callback/.python-version b/gitapp-callback/.python-version
new file mode 100644
index 00000000..e4fba218
--- /dev/null
+++ b/gitapp-callback/.python-version
@@ -0,0 +1 @@
+3.12
diff --git a/gitapp-callback/Dockerfile b/gitapp-callback/Dockerfile
index 5698b6a0..c872431a 100644
--- a/gitapp-callback/Dockerfile
+++ b/gitapp-callback/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 WORKDIR /app
 
@@ -10,7 +10,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 # Install curl for health checks
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends curl && \
+    apt-get install -y --no-install-recommends curl git && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
@@ -21,6 +21,7 @@ RUN pip install --no-cache-dir -r requirements.txt
 # Copy application code
 COPY app.py .
 COPY templates/ templates/
+COPY static/ static/
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
diff --git a/gitapp-callback/README.md b/gitapp-callback/README.md
index 9cd5f9b1..6f2a4f49 100644
--- a/gitapp-callback/README.md
+++ b/gitapp-callback/README.md
@@ -210,14 +210,181 @@ spec:
     app: gitapp-callback
 ```
 
+## References
+https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/about-the-user-authorization-callback-url
+
+
 ### GitHub App Configuration
 
 1. Go to your GitHub App settings
 2. Set "Post-installation redirect URL" to: `https://your-domain.com/registrations`
 3. GitHub will append `?installation_id=XXX&setup_action=install` automatically
 
+## Overview
+### initialize app
+```mermaid
+graph TD
+    Start["🚀 App Startup"] --> InitDB["Initialize SQLite Database"]
+    InitDB --> CreateTable["Create registrations table<br/>installation_id, data, timestamps"]
+    CreateTable --> EnsureRepo["ensure_repo_registration"]
+
+    EnsureRepo --> CheckRepo{REPO_REGISTRATION<br/>configured?}
+    CheckRepo -->|No| SkipRepo["⊘ Skip registrations checkout"]
+    CheckRepo -->|Yes| SetupGit["Configure git credentials<br/>GIT_CREDENTIALS_FILE"]
+    SetupGit --> ConfigHelper["git config --global<br/>credential.helper store"]
+    ConfigHelper --> CheckPath{REGISTRATIONS_PATH<br/>exists?}
+
+    CheckPath -->|No| CloneRepo["Clone registrations repo<br/>git clone REPO_REGISTRATION"]
+    CloneRepo --> ReadyApp["✓ App Ready"]
+
+    CheckPath -->|Yes| CheckGit{.git directory<br/>exists?}
+    CheckGit -->|Yes| FetchOrigin["Fetch and update repo<br/>git fetch origin --prune"]
+    FetchOrigin --> GetBranch["Get default branch<br/>git symbolic-ref refs/remotes/origin/HEAD"]
+    GetBranch --> Checkout["git checkout default_branch"]
+    Checkout --> Reset["git reset --hard<br/>origin/default_branch"]
+    Reset --> ReadyApp
+
+    CheckGit -->|No| CheckEmpty{Directory<br/>not empty?}
+    CheckEmpty -->|Yes| WarnEmpty["⚠️ Warn: skip if dir not empty"]
+    CheckEmpty -->|No| ReadyApp
+
+    SkipRepo --> ReadyApp
+    WarnEmpty --> ReadyApp
+
+    ReadyApp --> InitComplete["✓ Initialization Complete<br/>Ready for HTTP requests"]
+
+    style Start fill:#e1f5ff
+    style ReadyApp fill:#c8e6c9
+    style InitComplete fill:#c8e6c9,stroke:#4caf50,stroke-width:2px
+
+```
+
+### Get registration flow
+```mermaid
+graph TD
+    GetReq["GET /registrations"] --> ExtractParams["Extract installation_id<br/>and setup_action params"]
+    ExtractParams --> ValInstallID{installation_id<br/>present?}
+
+    ValInstallID -->|No| Err400A["❌ Return 400<br/>Missing installation_id"]
+    ValInstallID -->|Yes| ValInteger{installation_id<br/>is integer?}
+
+    ValInteger -->|No| Err400B["❌ Return 400<br/>Invalid format"]
+    ValInteger -->|Yes| FetchRepos["Fetch repositories from<br/>GitHub API<br/>get_installation_repositories"]
+    FetchRepos --> ValFetch{Fetch<br/>success?}
+
+    ValFetch -->|No| Err500A["❌ Return 500<br/>GitHub API error"]
+    ValFetch -->|Yes| ValAction{setup_action<br/>valid?}
+
+    ValAction -->|No| Err400C["❌ Return 400<br/>Invalid setup_action"]
+    ValAction -->|Yes| CheckAction{setup_action<br/>== install?}
+
+    CheckAction -->|Yes| CheckExists{Registration<br/>exists?}
+    CheckExists -->|Yes| Redirect["⤴️ Redirect to update<br/>with setup_action=update"]
+    CheckExists -->|No| DisplayForm["✓ Display registration form<br/>initial_data = null"]
+
+    CheckAction -->|No| CheckExistsUpdate{Registration<br/>exists?}
+    CheckExistsUpdate -->|No| Err404["❌ Return 404<br/>Not found for update"]
+    CheckExistsUpdate -->|Yes| LoadForm["✓ Load existing data<br/>from database<br/>and display form"]
+
+    Redirect --> Done["Return HTML response"]
+    DisplayForm --> Done
+    LoadForm --> Done
+    Err400A --> Done
+    Err400B --> Done
+    Err400C --> Done
+    Err500A --> Done
+    Err404 --> Done
+
+    style GetReq fill:#e1f5ff
+    style DisplayForm fill:#fff9c4
+    style LoadForm fill:#fff9c4
+    style Done fill:#c8e6c9
+    style Err400A fill:#ffccbc
+    style Err400B fill:#ffccbc
+    style Err400C fill:#ffccbc
+    style Err500A fill:#ffccbc
+    style Err404 fill:#ffccbc
+
+```
+
+### Validate registration
+```mermaid
+graph TD
+    PostReq["POST /registrations"] --> ExtractForm["Extract form data<br/>installation_id, defaultBranch,<br/>admin/readUsers, buckets"]
+    ExtractForm --> ValInstall{installation_id<br/>present?}
+
+    ValInstall -->|No| FormErr400A["❌ Return 400"]
+    ValInstall -->|Yes| ValAdmin{Admin users<br/>present?}
+
+    ValAdmin -->|No| FormErr400B["❌ Return 400"]
+    ValAdmin -->|Yes| ParseEmails["Parse email lists<br/>admin_users, read_users"]
+    ParseEmails --> ValEmails{All emails<br/>valid format?}
+
+    ValEmails -->|No| FormErr400C["❌ Return 400<br/>Invalid email"]
+    ValEmails -->|Yes| ParseBuckets["Parse S3 bucket configs<br/>dataBucket & artifactBucket"]
+    ParseBuckets --> ValBuckets{Bucket config<br/>valid?}
+
+    ValBuckets -->|No| FormErr400D["❌ Return 400<br/>Invalid bucket config"]
+    ValBuckets -->|Yes| CreateConfig["Create registration_config dict"]
+    CreateConfig --> FetchReposForm["Fetch repositories<br/>from GitHub API"]
+    FetchReposForm --> ValFetchForm{Fetch<br/>success?}
+
+    ValFetchForm -->|No| FormErr500A["❌ Return 500"]
+    ValFetchForm -->|Yes| CheckReposExist{Repositories<br/>found?}
+
+    CheckReposExist -->|No| FormErr500B["❌ Return 500<br/>No repos found"]
+    CheckReposExist -->|Yes| SaveDB["save_registration"]
+    
+```
+
+
+### Upsert registration flow
+```mermaid
+graph TD
+    PostReq["POST /registrations"] --> ExtractForm["Extract form data<br/>installation_id, defaultBranch,<br/>admin/readUsers, buckets"]
+    ExtractForm --> ValidateForm["Validate required fields<br/>emails, bucket config"]
+    ValidateForm -->|Error| FormErr["❌ Return 400/500 with error"]
+    ValidateForm --> FetchReposForm["Fetch installation repos<br/>GitHub API"]
+    FetchReposForm -->|Error| FormErr
+    FetchReposForm --> SaveDB["save_registration<br/>SQLite + optional Vault"]
+    SaveDB --> EnsureRepo["ensure_repo_registration<br/>configure git, fetch default"]
+    EnsureRepo --> FetchOriginPR["git fetch --all --prune"]
+    FetchOriginPR --> GetDefaultBranch["Get origin/HEAD default branch"]
+    GetDefaultBranch --> CheckLocalBranch{"Local branch exists?"}
+    CheckLocalBranch -->|Yes| CheckoutLocal["git checkout branch"]
+    CheckLocalBranch -->|No| CheckRemoteBranch{"Remote branch exists?"}
+    CheckRemoteBranch -->|Yes| CheckoutRemote["git checkout branch"]
+    CheckRemoteBranch -->|No| CreateBranch["git checkout -B branch<br/>origin/default"]
+    CheckoutLocal --> SyncRemote["git fetch origin branch<br/>git reset --hard origin/branch"]
+    CheckoutRemote --> SyncRemote
+    CreateBranch --> WriteFile
+    SyncRemote --> WriteFile["Write registration YAML<br/>registrations/owner/repo.yaml"]
+    WriteFile --> GitAdd["git add file"]
+    GitAdd --> GitCommit["git commit --allow-empty<br/>-m branch_name"]
+    GitCommit --> GitPush["git push -u origin branch"]
+    GitPush -->|Error| PRErr["❌ Return 500<br/>registration saved but PR failed"]
+    GitPush --> CreateGHPR["Create/lookup PR via GitHub API"]
+    CreateGHPR -->|Error| PRErr
+    CreateGHPR --> AddReviewer["Request reviewer\n(Copilot)"]
+    AddReviewer -->|Error| PRErr
+    AddReviewer --> SuccessResp["✓ Return success<br/>JSON or HTML summary"]
+    FormErr --> Done["Respond"]
+    PRErr --> Done
+    SuccessResp --> Done
+
+    style PostReq fill:#e1f5ff
+    style SaveDB stroke:#f57c00,stroke-width:2px
+    style EnsureRepo stroke:#f57c00,stroke-width:2px
+    style SuccessResp fill:#c8e6c9
+    style FormErr fill:#ffccbc
+    style PRErr fill:#fff9c4
+
+```
+
+
 ## Future Enhancements
 
+- [ ] refactor tests to use pytest fixtures/mocks
 - [ ] Persist configuration to Kubernetes CRD (RepoRegistration)
 - [ ] Integrate with GitHub API to fetch repository details
 - [ ] Validate installation_id with GitHub API
diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 29953424..c0fd7ced 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -17,9 +17,20 @@
 import re
 import sqlite3
 import json
+import subprocess
 from pathlib import Path
 from flask import Flask, request, render_template, jsonify, redirect, url_for
 import logging
+import jwt
+import time
+import requests
+from typing import List, Dict, Optional, Tuple
+import hvac
+import yaml
+from urllib.parse import urlparse
+
+EMAIL_PATTERN = re.compile(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$")
+
 
 # Configure logging
 logging.basicConfig(
@@ -27,15 +38,459 @@
 )
 logger = logging.getLogger(__name__)
 
-app = Flask(__name__)
+app = Flask(__name__, static_url_path="/registrations/static")
 app.secret_key = os.environ.get("SECRET_KEY", "dev-secret-key-change-in-production")
 
 # Configuration
-GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME", "calypr-workflows")
+# GitHub App Configuration
+GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME")  # Display name of the GitHub App (e.g., "calypr-workflows")
+GITHUB_APP_ID = os.environ.get("GITHUB_APP_ID")  # GitHub App ID for JWT authentication
+GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH")  # Path to GitHub App private key file for signing JWTs
+GITHUB_PAT = os.environ.get("GITHUB_PAT")  # Personal Access Token for git operations (clone, push) in registrations repo
+
+# Repository Configuration
+REPO_REGISTRATION = os.environ.get("REPO_REGISTRATION")  # Git URL of the registrations repository where registration files are stored
+
+# Vault Configuration
+VAULT_ADDR = os.environ.get("VAULT_ADDR")  # HashiCorp Vault address (e.g., "https://vault.example.com")
+VAULT_TOKEN = os.environ.get("VAULT_TOKEN")  # Vault authentication token for storing S3 bucket credentials
+
+# Git Authentication
+GIT_CREDENTIALS_FILE = os.environ.get("GIT_CREDENTIALS_FILE")  # Path to git credentials file (e.g., /root/.git-credentials) for git credential.helper
+
 
 # Default to /tmp in development/test, /var/registrations in production
 DEFAULT_DB_PATH = "/tmp/registrations.sqlite" if os.environ.get("FLASK_ENV") == "development" or os.environ.get("TESTING") else "/var/registrations/registrations.sqlite"
 DB_PATH = os.environ.get("DB_PATH", DEFAULT_DB_PATH)
+# get current directory
+REPO_ROOT = Path(__file__).resolve().parents[0]
+REGISTRATIONS_PATH = Path("registrations")
+
+
+def run_git_command(args: List[str], repo_dir: Path) -> str:
+    """
+    Run a git command and return stdout.
+
+    Args:
+        args: List of git arguments (without the leading 'git')
+        repo_dir: Working directory to run git in
+        use_auth: Whether to attach the PAT to git HTTP requests
+    """
+    cmd = ["git"]
+    cmd.extend(args)
+    try:
+        logging.info(" ".join(cmd))
+        result = subprocess.run(
+            cmd,
+            cwd=repo_dir,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+        return result.stdout.strip()
+    except subprocess.CalledProcessError as e:
+        logging.error(
+                "Git command failed: %s\nReturn code: %s\nStdout: %s\nStderr: %s\ncwd: %s",
+            " ".join(cmd),
+            e.returncode,
+            e.stdout,
+            e.stderr,
+            repo_dir,
+        )
+        return "FAILED"    
+    return result.stdout.strip()
+
+
+def parse_repo_owner_name(repo_url: str) -> Tuple[str, str]:
+    """
+    Parse a GitHub repository URL into owner and repo name.
+    """
+    if repo_url.startswith("git@"):
+        path = repo_url.split(":", 1)[1]
+    elif "github.com/" in repo_url:
+        path = repo_url.split("github.com/", 1)[1]
+    else:
+        path = repo_url
+    path = path.strip("/")
+    if path.endswith(".git"):
+        path = path[:-4]
+    owner, repo = path.split("/", 1)
+    return owner, repo
+
+
+def sanitize_log_value(value: Optional[str], max_length: int) -> str:
+    if not value:
+        return ""
+    safe_value = "".join(c for c in value[:max_length] if c.isalnum() or c in "-_")
+    return safe_value
+
+
+def parse_installation_id(raw_installation_id: Optional[str]) -> Optional[int]:
+    if not raw_installation_id:
+        return None
+    try:
+        return int(raw_installation_id)
+    except ValueError:
+        return None
+
+
+def parse_email_list(raw_value: str) -> List[str]:
+    return [email.strip() for email in raw_value.split(",") if email.strip()]
+
+
+def validate_email_list(emails: List[str]) -> Optional[str]:
+    for email in emails:
+        if not EMAIL_PATTERN.match(email):
+            return f"Invalid email address: {email}"
+    return None
+
+
+def parse_bucket_config(prefix: str, form: Dict[str, str]) -> Optional[Dict[str, any]]:
+    """Parse S3 bucket configuration from form data."""
+    bucket_name = form.get(f"{prefix}_bucket", "").strip()
+    if not bucket_name:
+        return None
+
+    access_key = form.get(f"{prefix}_accessKey", "").strip()
+    secret_key = form.get(f"{prefix}_secretKey", "").strip()
+
+    if not access_key or not secret_key:
+        raise ValueError(
+            f"{prefix.replace('_', ' ').title()} requires both access key and secret key"
+        )
+
+    is_aws = form.get(f"{prefix}_is_aws") == "on"
+
+    config = {
+        "bucket": bucket_name,
+        "accessKey": access_key,
+        "secretKey": secret_key,
+        "is_aws": is_aws,
+    }
+
+    if not is_aws:
+        hostname = form.get(f"{prefix}_hostname", "").strip()
+        region = form.get(f"{prefix}_region", "").strip()
+        path_style = form.get(f"{prefix}_pathStyle") == "on"
+
+        if not hostname or not region:
+            raise ValueError(
+                f"{prefix.replace('_', ' ').title()} (non-AWS) requires hostname and region"
+            )
+
+        if not hostname.startswith("https://"):
+            raise ValueError(
+                f"{prefix.replace('_', ' ').title()} hostname must start with https://"
+            )
+
+        config["hostname"] = hostname
+        config["region"] = region
+        config["pathStyle"] = path_style
+
+    return config
+
+
+def ensure_repo_registration() -> None:
+    """
+    Ensure the REPO_REGISTRATION repository is checked out.
+    """
+    if not REPO_REGISTRATION:
+        logger.info("REPO_REGISTRATION not set; skipping registrations checkout.")
+        return
+    if not GITHUB_PAT:
+        raise ValueError("GITHUB_PAT environment variable not set")
+
+    # Configure git to use the credentials file
+    logger.info(f"Setting git credential.helper to {GIT_CREDENTIALS_FILE}")
+    result = run_git_command(["config", "--global", "credential.helper", f'store --file={GIT_CREDENTIALS_FILE}'], REPO_ROOT) 
+    logger.info(f"result from setting git credential.helper {result}")
+    # Configure author name and email
+    # TODO make name and email configurable
+    run_git_command(["config", "--global", "user.name", GITHUB_APP_NAME or "GitHub App"], REPO_ROOT)
+    run_git_command(["config", "--global", "user.email", f"calyr@example.com"], REPO_ROOT)
+
+    if not REGISTRATIONS_PATH.exists():
+        logger.info("Cloning registrations repository.")
+        run_git_command(
+            ["clone", REPO_REGISTRATION, str(REGISTRATIONS_PATH)],
+            REPO_ROOT,
+        )
+        return
+    if (REGISTRATIONS_PATH / ".git").exists():
+        logger.info("Updating registrations repository checkout.")
+        run_git_command(
+            ["fetch", "--all", "--prune"],
+            REGISTRATIONS_PATH,
+        )
+        default_branch = get_default_branch(REGISTRATIONS_PATH)
+        run_git_command(["checkout", default_branch], REGISTRATIONS_PATH)
+        run_git_command(
+            ["reset", "--hard", f"origin/{default_branch}"],
+            REGISTRATIONS_PATH,
+        )
+        return
+    if any(REGISTRATIONS_PATH.iterdir()):
+        logger.warning(
+            "Registrations path exists and is not a git repo; skipping checkout."
+        )
+    return
+
+
+def get_default_branch(repo_dir: Path) -> str:
+    """
+    Determine the default branch for a repo, falling back to main.
+    """
+    try:
+        ref = run_git_command(
+            ["symbolic-ref", "refs/remotes/origin/HEAD"],
+            repo_dir,
+        )
+        return ref.split("/")[-1]
+    except subprocess.CalledProcessError:
+        return "main"
+
+
+def create_registration_pull_request(
+    installation_id: str, registration_config: Dict[str, any], repositories: List[Dict[str, any]]
+) -> None:
+    """
+    Create or update a RepoRegistration file and open a PR in the registrations repo.
+    """
+    if not REPO_REGISTRATION:
+        logger.info("REPO_REGISTRATION not set; skipping registration PR creation.")
+        return
+    if not GITHUB_PAT:
+        raise ValueError("GITHUB_PAT environment variable not set")
+    if not repositories:
+        raise ValueError("No repositories available to generate registration file.")
+
+    ensure_repo_registration()
+
+    if len(repositories) > 1:
+        logging.warning("Multiple repositories found for installation; using the first one.")
+
+    full_name = repositories[0]["full_name"]
+    owner, repo_name = full_name.split("/")
+
+    registration_repo_owner, registration_repo_name = parse_repo_owner_name(REPO_REGISTRATION)
+
+    registration_file = REGISTRATIONS_PATH / owner / f"{repo_name}.yaml"
+    branch_action = "update" if registration_file.exists() else "create"
+    branch_name = f"chore/{branch_action}-{owner}-{repo_name}"
+
+    run_git_command(["fetch", "--all", "--prune"], REGISTRATIONS_PATH)
+    default_branch = get_default_branch(REGISTRATIONS_PATH)
+
+    # python
+    local_exists = run_git_command(
+        ["show-ref", "--verify", "--quiet", f"refs/heads/{branch_name}"],
+        REGISTRATIONS_PATH,
+    ) != "FAILED"
+
+    remote_exists = False
+    if not local_exists:
+        remote_exists = run_git_command(
+            ["ls-remote", "--exit-code", "--heads", "origin", branch_name],
+            REGISTRATIONS_PATH,
+        ) != "FAILED"
+    else:
+        remote_exists = True
+
+    if remote_exists:
+        # Switch to existing branch and fetch latest
+        logger.info(f"Branch {branch_name} already exists; switching to it and fetching latest.")
+        run_git_command(["checkout", branch_name], REGISTRATIONS_PATH)
+        run_git_command(["fetch", "origin", branch_name], REGISTRATIONS_PATH)
+        run_git_command(["reset", "--hard", f"origin/{branch_name}"], REGISTRATIONS_PATH)
+    else:
+        # Create new branch from default branch
+        logger.info(f"Creating new branch {branch_name} from {default_branch}.")
+        run_git_command(
+            ["checkout", "-B", branch_name, f"origin/{default_branch}"],
+            REGISTRATIONS_PATH,
+        )
+
+
+    registration_file.parent.mkdir(parents=True, exist_ok=True)
+    registration_payload = {
+        "installation_id": installation_id,
+        "registration_config": registration_config,
+    }
+    registration_file.write_text(
+        yaml.dump(registration_payload, sort_keys=True, default_flow_style=False)
+    )
+
+    run_git_command(
+        ["add", str(registration_file.relative_to(REGISTRATIONS_PATH))],
+        REGISTRATIONS_PATH,
+    )
+    run_git_command(
+        ["commit", "--allow-empty", "-m", branch_name],
+        REGISTRATIONS_PATH,
+    )
+
+    run_git_command(["push", "-u", "origin", branch_name], REGISTRATIONS_PATH)
+
+    pr_body = (
+        f"Automated repo registration for `{owner}/{repo_name}`.\n\n"
+        f"Installation ID: `{installation_id}`."
+    )
+    pr_url = f"https://api.github.com/repos/{registration_repo_owner}/{registration_repo_name}/pulls"
+    headers = {
+        "Authorization": f"token {GITHUB_PAT}",
+        "Accept": "application/vnd.github+json",
+    }
+    response = requests.post(
+        pr_url,
+        headers=headers,
+        json={
+            "title": branch_name,
+            "head": branch_name,
+            "base": default_branch,
+            "body": pr_body,
+        },
+    )
+
+    if response.status_code == 422:
+        existing_response = requests.get(
+            pr_url,
+            headers=headers,
+            params={"state": "open", "head": f"{registration_repo_owner}:{branch_name}"},
+        )
+        existing_response.raise_for_status()
+        pulls = existing_response.json()
+        if pulls:
+            pr_number = pulls[0]["number"]
+        else:
+            response.raise_for_status()
+    else:
+        response.raise_for_status()
+        pr_number = response.json()["number"]
+
+    reviewers_url = (
+        f"https://api.github.com/repos/{registration_repo_owner}/"
+        f"{registration_repo_name}/pulls/{pr_number}/requested_reviewers"
+    )
+    try:
+        reviewers_response = requests.post(
+            reviewers_url,
+            headers=headers,
+            json={"reviewers": ["Copilot"]},
+        )
+        reviewers_response.raise_for_status()
+        logger.info(f"Successfully added co-pilot as reviewer to PR #{pr_number}")
+    except requests.HTTPError as e:
+        # Log warning but don't fail the entire operation
+        logger.warning(reviewers_url)
+        logger.warning(
+            f"Failed to add reviewer to PR #{pr_number}: {e.response.status_code} - {e.response.text}"
+        )
+        raise
+
+
+def get_github_app_jwt() -> str:
+    """
+    Generate a JWT for GitHub App authentication.
+
+    Returns:
+        JWT token string for authenticating as the GitHub App
+
+    Raises:
+        ValueError: If GITHUB_APP_ID is not set
+        FileNotFoundError: If private key file doesn't exist
+    """
+    if not GITHUB_APP_ID:
+        raise ValueError("GITHUB_APP_ID environment variable not set")
+
+    # Read private key
+    with open(GITHUB_PRIVATE_KEY_PATH, 'rb') as key_file:
+        private_key = key_file.read()
+
+    # Create JWT payload
+    payload = {
+        'iat': int(time.time()),
+        'exp': int(time.time()) + 600,  # 10 minutes
+        'iss': GITHUB_APP_ID
+    }
+
+    # Generate JWT
+    token = jwt.encode(payload, private_key, algorithm='RS256')
+    return token
+
+
+def get_installation_access_token(installation_id: str) -> str:
+    """
+    Get an installation access token for API calls.
+
+    Args:
+        installation_id: GitHub installation ID
+
+    Returns:
+        Access token for the installation
+
+    Raises:
+        requests.HTTPError: If GitHub API request fails
+    """
+    jwt_token = get_github_app_jwt()
+
+    url = f"https://api.github.com/app/installations/{installation_id}/access_tokens"
+    headers = {
+        "Authorization": f"Bearer {jwt_token}",
+        "Accept": "application/vnd.github.v3+json"
+    }
+
+    response = requests.post(url, headers=headers)
+    response.raise_for_status()
+
+    return response.json()['token']
+
+
+def get_installation_repositories(installation_id: str) -> List[Dict[str, any]]:
+    """
+    Retrieve repositories for a GitHub App installation.
+
+    Args:
+        installation_id: GitHub installation ID
+
+    Returns:
+        List of repository dictionaries with keys like:
+        - 'id': Repository ID
+        - 'name': Repository name
+        - 'full_name': Owner/repo format
+        - 'private': Boolean for private/public
+        - 'html_url': Repository URL
+
+    Raises:
+        requests.HTTPError: If GitHub API request fails
+    """
+    access_token = get_installation_access_token(installation_id)
+
+    url = "https://api.github.com/installation/repositories"
+    headers = {
+        "Authorization": f"token {access_token}",
+        "Accept": "application/vnd.github.v3+json"
+    }
+
+    repositories = []
+    page = 1
+
+    while True:
+        response = requests.get(
+            url,
+            headers=headers,
+            params={"per_page": 100, "page": page}
+        )
+        response.raise_for_status()
+
+        data = response.json()
+        repositories.extend(data.get('repositories', []))
+
+        # Check if there are more pages
+        if len(data.get('repositories', [])) < 100:
+            break
+        page += 1
+
+    return repositories
 
 
 def init_db():
@@ -44,7 +499,9 @@ def init_db():
     
     Creates the registrations table if it doesn't exist.
     Table schema:
-        - installation_id: TEXT PRIMARY KEY
+        - git_host: TEXT
+        - full_name: TEXT
+        - installation_id: TEXT
         - data: TEXT (JSON serialized RepoRegistration)
         - created_at: TIMESTAMP
         - updated_at: TIMESTAMP
@@ -56,74 +513,276 @@ def init_db():
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
     
-    cursor.execute("""
-        CREATE TABLE IF NOT EXISTS registrations (
-            installation_id TEXT PRIMARY KEY,
-            data TEXT NOT NULL,
-            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-            updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    def create_registrations_table():
+        cursor.execute("""
+            CREATE TABLE IF NOT EXISTS registrations (
+                git_host TEXT NOT NULL,
+                full_name TEXT NOT NULL,
+                installation_id TEXT NOT NULL,
+                data TEXT NOT NULL,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                PRIMARY KEY (git_host, full_name)
+            )
+        """)
+
+    cursor.execute("PRAGMA table_info(registrations)")
+    columns = {row[1] for row in cursor.fetchall()}
+
+    if not columns:
+        create_registrations_table()
+    elif "git_host" not in columns or "full_name" not in columns:
+        logger.info("Migrating legacy registrations table to git_host/full_name primary key.")
+        cursor.execute("ALTER TABLE registrations RENAME TO registrations_legacy")
+        create_registrations_table()
+        cursor.execute(
+            "SELECT installation_id, data, created_at, updated_at FROM registrations_legacy"
         )
-    """)
+        rows = cursor.fetchall()
+        for installation_id, data, created_at, updated_at in rows:
+            try:
+                registration_data = json.loads(data)
+            except json.JSONDecodeError:
+                logger.warning("Skipping legacy registration with invalid JSON payload.")
+                continue
+            full_name = registration_data.get("full_name")
+            if not full_name:
+                logger.warning(
+                    "Skipping legacy registration without full_name for installation_id=%s.",
+                    installation_id,
+                )
+                continue
+            git_host = registration_data.get("git_host") or "github.com"
+            cursor.execute(
+                """
+                INSERT INTO registrations (
+                    git_host,
+                    full_name,
+                    installation_id,
+                    data,
+                    created_at,
+                    updated_at
+                )
+                VALUES (?, ?, ?, ?, ?, ?)
+                """,
+                (git_host, full_name, installation_id, data, created_at, updated_at),
+            )
+        logger.info(
+            "Legacy registrations migrated where possible; "
+            "legacy table preserved as registrations_legacy."
+        )
+    else:
+        create_registrations_table()
     
     conn.commit()
     conn.close()
     logger.info(f"Database initialized at {DB_PATH}")
 
 
-def get_registration(installation_id):
+def extract_git_host(repository: Dict[str, any]) -> str:
+    """
+    Extract git host from repository metadata, defaulting to github.com.
+    """
+    if not repository:
+        return "github.com"
+    for key in ("html_url", "git_url", "ssh_url", "clone_url"):
+        url = repository.get(key)
+        if not url:
+            continue
+        if url.startswith("git@"):
+            host_part = url.split("@", 1)[1].split(":", 1)[0]
+            if host_part:
+                return host_part
+        parsed = urlparse(url)
+        if parsed.netloc:
+            return parsed.netloc
+    return "github.com"
+
+
+def resolve_registration_identity(
+    repository: Optional[Dict[str, any]] = None,
+    git_host: Optional[str] = None,
+    full_name: Optional[str] = None,
+) -> Tuple[str, str]:
+    if repository:
+        full_name = repository.get("full_name") or full_name
+        git_host = repository.get("git_host") or git_host or extract_git_host(repository)
+
+    if not full_name:
+        raise ValueError("full_name is required to locate the registration.")
+
+    return git_host or "github.com", full_name
+
+
+def get_registration(installation_id, repository=None, git_host=None, full_name=None):
     """
     Get a registration from the database.
     
     Args:
         installation_id: The GitHub installation ID
+        repository: Optional repository associated with the installation
+        git_host: Optional git host override
+        full_name: Optional repository full name override
         
     Returns:
         dict: The registration data or None if not found
     """
-    conn = sqlite3.connect(DB_PATH)
-    cursor = conn.cursor()
-    
-    cursor.execute(
-        "SELECT data FROM registrations WHERE installation_id = ?",
-        (installation_id,)
-    )
-    
-    row = cursor.fetchone()
-    conn.close()
-    
+
+    try:
+        resolved_git_host, resolved_full_name = resolve_registration_identity(
+            repository=repository,
+            git_host=git_host,
+            full_name=full_name,
+        )
+    except ValueError as e:
+        logger.warning("Unable to resolve registration identity: %s", e)
+        return None
+
+    with sqlite3.connect(DB_PATH) as conn:
+        cursor = conn.cursor()
+        cursor.execute(
+            "SELECT data FROM registrations WHERE git_host = ? AND full_name = ?",
+            (resolved_git_host, resolved_full_name),
+        )
+        row = cursor.fetchone()
+
     if row:
-        return json.loads(row[0])
+        registration_data = json.loads(row[0])
+
+        if repository and VAULT_ADDR and VAULT_TOKEN:
+            full_name = repository["full_name"]
+            owner, repo_name = full_name.split("/")
+            data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
+            artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
+            try:
+                client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
+                data_bucket_response = client.secrets.kv.v2.read_secret_version(
+                    path=data_vault_path,
+                    mount_point="kv",
+                )
+                artifact_bucket_response = client.secrets.kv.v2.read_secret_version(
+                    path=artifact_vault_path,
+                    mount_point="kv",
+                )
+                if data_bucket_response:
+                    created_time = (
+                        data_bucket_response
+                        .get("data", {})
+                        .get("metadata", {})
+                        .get("created_time")
+                    )
+                    if created_time:
+                        registration_data["dataBucketCreatedTime"] = created_time
+                if artifact_bucket_response:
+                    created_time = (
+                        artifact_bucket_response
+                        .get("data", {})
+                        .get("metadata", {})
+                        .get("created_time")
+                    )
+                    if created_time:
+                        registration_data["artifactBucketCreatedTime"] = created_time
+            except Exception as e:
+                logger.warning(f"Failed to retrieve bucket configurations from Vault: {e}")
+
+        return registration_data
+    logger.error(
+        "Did not find registration for git_host=%s full_name=%s",
+        resolved_git_host,
+        resolved_full_name,
+    )
     return None
 
 
-def save_registration(installation_id, registration_data):
+def save_registration(installation_id, registration_data, repositories=None, git_host=None, full_name=None):
     """
     Save or update a registration in the database.
     
     Args:
         installation_id: The GitHub installation ID
         registration_data: The RepoRegistration configuration dict
+        repositories: Optional list of repositories associated with the installation
+        git_host: Optional git host override
+        full_name: Optional repository full name override
     """
-    conn = sqlite3.connect(DB_PATH)
-    cursor = conn.cursor()
-    
-    data_json = json.dumps(registration_data)
-    
-    cursor.execute("""
-        INSERT INTO registrations (installation_id, data, created_at, updated_at)
-        VALUES (?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
-        ON CONFLICT(installation_id) 
-        DO UPDATE SET 
-            data = excluded.data,
-            updated_at = CURRENT_TIMESTAMP
-    """, (installation_id, data_json))
-    
-    conn.commit()
-    conn.close()
-    logger.info(f"Registration saved for installation_id={installation_id}")
+
+    repository = repositories[0] if repositories else None
+    resolved_git_host, resolved_full_name = resolve_registration_identity(
+        repository=repository,
+        git_host=git_host,
+        full_name=full_name or registration_data.get("full_name"),
+    )
+
+    registration_payload = dict(registration_data)
+    registration_payload["git_host"] = resolved_git_host
+    registration_payload["full_name"] = resolved_full_name
+    registration_payload["installation_id"] = installation_id
+
+    data_bucket = registration_payload.pop("dataBucket", None)
+    artifact_bucket = registration_payload.pop("artifactBucket", None)
+
+    # Save bucket configurations to Vault
+    if repositories:
+        if len(repositories) > 1:
+            logging.warning("Multiple repositories found for installation; using the first one.")
+
+        full_name = repositories[0]['full_name']
+        owner, repo_name = full_name.split('/')
+        try:
+            client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
+
+            if data_bucket:
+                data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
+                client.secrets.kv.v2.create_or_update_secret(
+                    path=data_vault_path,
+                    secret=data_bucket,
+                    mount_point="kv"
+                )
+                logger.info(f"Saved dataBucket to Vault at {data_vault_path}")
+
+            if artifact_bucket:
+                artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
+                client.secrets.kv.v2.create_or_update_secret(
+                    path=artifact_vault_path,
+                    secret=artifact_bucket,
+                    mount_point="kv"
+                )
+                logger.info(f"Saved artifactBucket to Vault at {artifact_vault_path}")
+
+        except Exception as e:
+            logger.error(f"Failed to save bucket configurations to Vault: {e}")
+            raise
+
+    data_json = json.dumps(registration_payload)
+
+    with sqlite3.connect(DB_PATH) as conn:
+        cursor = conn.cursor()
+        cursor.execute("""
+            INSERT INTO registrations (
+                git_host,
+                full_name,
+                installation_id,
+                data,
+                created_at,
+                updated_at
+            )
+            VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+            ON CONFLICT(git_host, full_name) 
+            DO UPDATE SET 
+                installation_id = excluded.installation_id,
+                data = excluded.data,
+                updated_at = CURRENT_TIMESTAMP
+        """, (resolved_git_host, resolved_full_name, installation_id, data_json))
+    logger.info(
+        "Registration saved for git_host=%s full_name=%s installation_id=%s",
+        resolved_git_host,
+        resolved_full_name,
+        installation_id,
+    )
 
 
-# Initialize database on startup
+# Initialize module and database on startup
+ensure_repo_registration()
 init_db()
 
 
@@ -158,6 +817,10 @@ def registrations_form():
     installation_id = request.args.get("installation_id")
     setup_action = request.args.get("setup_action", "install")
 
+    # retrieve the repository this installation is for
+    # installation_id is required
+
+
     # Validate installation_id is present
     if not installation_id:
         logger.warning("Missing installation_id in callback")
@@ -170,11 +833,9 @@ def registrations_form():
             400,
         )
     
-    # Validate installation_id is an integer
-    try:
-        int(installation_id)
-    except ValueError:
-        logger.warning(f"Invalid installation_id (not an integer): {installation_id[:50]}")
+    parsed_installation_id = parse_installation_id(installation_id)
+    if parsed_installation_id is None:
+        logger.warning("Invalid installation_id (not an integer): %s", installation_id[:50])
         return (
             render_template(
                 "error.html",
@@ -183,7 +844,32 @@ def registrations_form():
             ),
             400,
         )
-    
+
+    # Retrieve repositories for this installation
+    try:
+        repositories = get_installation_repositories(installation_id)
+        logger.info(f"Retrieved {len(repositories)} repositories for installation {installation_id}")
+    except requests.HTTPError as e:
+        logger.error(f"Failed to retrieve repositories: {e}")
+        return (
+            render_template(
+                "error.html",
+                error_message="Failed to retrieve repository information from GitHub. Please try again.",
+                github_app_name=GITHUB_APP_NAME,
+            ),
+            500,
+        )
+    except Exception as e:
+        logger.exception("Unexpected error retrieving repositories")
+        return (
+            render_template(
+                "error.html",
+                error_message="An unexpected error occurred. Please try again.",
+                github_app_name=GITHUB_APP_NAME,
+            ),
+            500,
+        )
+
     # Validate setup_action is valid
     if setup_action not in ["install", "update"]:
         logger.warning(f"Invalid setup_action: {setup_action[:50]}")
@@ -197,35 +883,64 @@ def registrations_form():
         )
 
     # Sanitize values for logging (only alphanumeric and basic chars)
-    safe_installation_id = "".join(
-        c for c in (installation_id or "")[:50] if c.isalnum() or c in "-_"
-    )
-    safe_setup_action = "".join(c for c in (setup_action or "")[:20] if c.isalnum() or c in "-_")
+    safe_installation_id = sanitize_log_value(installation_id, 50)
+    safe_setup_action = sanitize_log_value(setup_action, 20)
     logger.info(
         f"Registration form requested: installation_id={safe_installation_id}, "
         f"action={safe_setup_action}"
     )
 
-    # Check if registration exists
-    existing_registration = get_registration(installation_id)
+    selected_repository = request.args.get("selected_repository")
+    total_repositories = len(repositories)
+    if len(repositories) > 1 and not selected_repository:
+        return render_template(
+            "select_repository.html",
+            installation_id=installation_id,
+            setup_action=setup_action,
+            repositories=repositories,
+            github_app_name=GITHUB_APP_NAME,
+        )
+    if selected_repository:
+        selected_repos = [r for r in repositories if r["full_name"] == selected_repository]
+        if not selected_repos:
+            logger.warning(
+                "Invalid repository selection for installation %s",
+                safe_installation_id,
+            )
+            return (
+                render_template(
+                    "error.html",
+                    error_message="Invalid repository selection.",
+                    github_app_name=GITHUB_APP_NAME,
+                ),
+                400,
+            )
+        repositories = selected_repos
+    elif len(repositories) == 1:
+        selected_repository = repositories[0]["full_name"]
+
+    repository = repositories[0] if repositories else None
+    existing_registration = get_registration(installation_id, repository)
+    creating_missing_registration = False
     
     # Handle install action
     if setup_action == "install":
         if existing_registration:
             # Installation already exists, warn user and redirect to update
             logger.warning(
-                f"Installation {safe_installation_id} already exists, redirecting to update"
+                f"Installation {safe_installation_id} {selected_repository}  already exists, redirecting to update"
             )
             return render_template(
                 "error.html",
                 error_message=(
-                    f"Installation {installation_id} is already registered. "
+                    f"Installation {installation_id} {selected_repository} is already registered. "
                     "Redirecting you to update the existing registration..."
                 ),
                 redirect_url=url_for(
                     "registrations_form",
                     installation_id=installation_id,
-                    setup_action="update"
+                    setup_action="update",
+                    selected_repository=selected_repository,
                 ),
                 github_app_name=GITHUB_APP_NAME,
             )
@@ -233,21 +948,12 @@ def registrations_form():
     # Handle update action
     elif setup_action == "update":
         if not existing_registration:
-            # No existing registration for update
-            logger.error(
-                f"Installation {safe_installation_id} not found for update"
-            )
-            return (
-                render_template(
-                    "error.html",
-                    error_message=(
-                        f"Installation {installation_id} not found. "
-                        "Please install the GitHub App first."
-                    ),
-                    github_app_name=GITHUB_APP_NAME,
-                ),
-                404,
+            logger.info(
+                "No existing registration for installation %s %s; proceeding to create one.",
+                safe_installation_id,
+                selected_repository,
             )
+            creating_missing_registration = True
 
     # Load existing data for update mode
     initial_data = existing_registration if setup_action == "update" else None
@@ -257,6 +963,11 @@ def registrations_form():
         installation_id=installation_id,
         setup_action=setup_action,
         initial_data=initial_data,
+        repositories=repositories,
+        selected_repository=selected_repository,
+        creating_missing_registration=creating_missing_registration,
+        multiple_repositories=total_repositories > 1,
+        repository_count=total_repositories,
         github_app_name=GITHUB_APP_NAME,
     )
 
@@ -280,9 +991,22 @@ def registrations_submit():
     Returns:
         JSON response with success/error status or redirect to success page
     """
+    def registration_pr_error(message: str):
+        if request.headers.get("Accept") == "application/json":
+            return jsonify({"success": False, "error": message}), 500
+        return (
+            render_template(
+                "error.html",
+                error_message=message,
+                github_app_name=GITHUB_APP_NAME,
+            ),
+            500,
+        )
+
     try:
         # Extract form data
         installation_id = request.form.get("installation_id", "").strip()
+        selected_repository = request.form.get("selected_repository", "").strip()
         default_branch = request.form.get("defaultBranch", "main").strip()
         admin_users_raw = request.form.get("adminUsers", "").strip()
         read_users_raw = request.form.get("readUsers", "").strip()
@@ -298,12 +1022,8 @@ def registrations_submit():
             )
 
         # Parse email lists
-        admin_users = [email.strip() for email in admin_users_raw.split(",") if email.strip()]
-        read_users = (
-            [email.strip() for email in read_users_raw.split(",") if email.strip()]
-            if read_users_raw
-            else []
-        )
+        admin_users = parse_email_list(admin_users_raw)
+        read_users = parse_email_list(read_users_raw)
 
         # Validate admin users
         if not admin_users:
@@ -312,68 +1032,74 @@ def registrations_submit():
                 400,
             )
 
-        # Basic email validation
-        email_pattern = r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"
-        for email in admin_users + read_users:
-            if not re.match(email_pattern, email):
-                return jsonify({"success": False, "error": f"Invalid email address: {email}"}), 400
-
-        # Parse bucket configurations
-        def parse_bucket_config(prefix):
-            """Parse S3 bucket configuration from form data."""
-            bucket_name = request.form.get(f"{prefix}_bucket", "").strip()
-            if not bucket_name:
-                return None
-
-            access_key = request.form.get(f"{prefix}_accessKey", "").strip()
-            secret_key = request.form.get(f"{prefix}_secretKey", "").strip()
-
-            # If bucket is set, accessKey and secretKey must exist
-            if not access_key or not secret_key:
-                raise ValueError(
-                    f"{prefix.replace('_', ' ').title()} requires both access key and secret key"
-                )
+        email_error = validate_email_list(admin_users + read_users)
+        if email_error:
+            return jsonify({"success": False, "error": email_error}), 400
 
-            is_aws = request.form.get(f"{prefix}_is_aws") == "on"
+        try:
+            data_bucket = parse_bucket_config("dataBucket", request.form)
+            artifact_bucket = parse_bucket_config("artifactBucket", request.form)
+        except ValueError as e:
+            return jsonify({"success": False, "error": str(e)}), 400
 
-            config = {
-                "bucket": bucket_name,
-                "accessKey": access_key,
-                "secretKey": secret_key,
-                "is_aws": is_aws,
-            }
+        # Retrieve repositories for this installation
+        try:
+            repositories = get_installation_repositories(installation_id)
+            logger.info(f"Retrieved {len(repositories)} repositories for installation {installation_id}")
+        except requests.HTTPError as e:
+            logger.error(f"Failed to retrieve repositories: {e}")
+            return (
+                render_template(
+                    "error.html",
+                    error_message="Failed to retrieve repository information from GitHub. Please try again.",
+                    github_app_name=GITHUB_APP_NAME,
+                ),
+                500,
+            )
+        except Exception as e:
+            logger.exception("Unexpected error retrieving repositories")
+            return (
+                render_template(
+                    "error.html",
+                    error_message="An unexpected error occurred. Please try again.",
+                    github_app_name=GITHUB_APP_NAME,
+                ),
+                500,
+            )
 
-            # If not AWS, hostname, region, and pathStyle should be complete
-            if not is_aws:
-                hostname = request.form.get(f"{prefix}_hostname", "").strip()
-                region = request.form.get(f"{prefix}_region", "").strip()
-                path_style = request.form.get(f"{prefix}_pathStyle") == "on"
+        if not repositories or len(repositories) == 0:
+            return (
+                jsonify(
+                    {
+                        "success": False,
+                        "error": "No repositories found for this installation",
+                    }
+                ),
+                500,
+            )
 
-                if not hostname or not region:
-                    raise ValueError(
-                        f"{prefix.replace('_', ' ').title()} (non-AWS) requires hostname and region"
-                    )
+        # Validate selected_repository if multiple repos exist
+        if len(repositories) > 1:
+            if not selected_repository:
+                return jsonify({"success": False, "error": "Repository selection is required"}), 400
 
-                if not hostname.startswith("https://"):
-                    raise ValueError(
-                        f"{prefix.replace('_', ' ').title()} hostname must start with https://"
-                    )
+            selected_repos = [r for r in repositories if r["full_name"] == selected_repository]
+            if not selected_repos:
+                return jsonify({"success": False, "error": "Invalid repository selection"}), 400
 
-                config["hostname"] = hostname
-                config["region"] = region
-                config["pathStyle"] = path_style
+            repositories = selected_repos
 
-            return config
+        logger.info(f"Repository registration submitted: installation_id={installation_id} repositories={repositories}")
 
-        try:
-            data_bucket = parse_bucket_config("dataBucket")
-            artifact_bucket = parse_bucket_config("artifactBucket")
-        except ValueError as e:
-            return jsonify({"success": False, "error": str(e)}), 400
+        resolved_git_host, resolved_full_name = resolve_registration_identity(
+            repository=repositories[0]
+        )
 
         # Create registration configuration
         registration_config = {
             "installation_id": installation_id,
+            "git_host": resolved_git_host,
+            "full_name": resolved_full_name,
             "defaultBranch": default_branch,
             "dataBucket": data_bucket,
             "artifactBucket": artifact_bucket,
@@ -381,10 +1107,19 @@ def parse_bucket_config(prefix):
             "readUsers": read_users,
         }
 
-        logger.info(f"Repository registration submitted: installation_id={installation_id}")
-
         # Save configuration to database
-        save_registration(installation_id, registration_config)
+        save_registration(installation_id, registration_config, repositories)
+
+        try:
+            create_registration_pull_request(
+                installation_id, registration_config, repositories
+            )
+        except Exception:
+            logger.exception("Failed to create registration pull request")
+            return registration_pr_error(
+                "Registration saved, but failed to create a pull request in the "
+                "registrations repository."
+            )
 
         # Return success response
         if request.headers.get("Accept") == "application/json":
diff --git a/gitapp-callback/requirements.txt b/gitapp-callback/requirements.txt
index 53ea1040..24ca734a 100644
--- a/gitapp-callback/requirements.txt
+++ b/gitapp-callback/requirements.txt
@@ -1,2 +1,8 @@
 Flask==3.0.0
 Werkzeug==3.0.1
+PyJWT==2.8.0
+cryptography==41.0.7
+requests==2.31.0
+hvac==1.2.1
+PyYAML==6.0.3
+
diff --git a/gitapp-callback/static/avatar.png b/gitapp-callback/static/avatar.png
new file mode 100644
index 00000000..a57cb8da
Binary files /dev/null and b/gitapp-callback/static/avatar.png differ
diff --git a/gitapp-callback/static/avatar.svg b/gitapp-callback/static/avatar.svg
new file mode 100644
index 00000000..abe26560
--- /dev/null
+++ b/gitapp-callback/static/avatar.svg
@@ -0,0 +1,26 @@
+<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Avatar icon">
+  <rect width="200" height="200" fill="white"/>
+  <g stroke="#1F2933" stroke-width="4" stroke-linecap="round" stroke-linejoin="round">
+    <line x1="36" y1="50" x2="100" y2="90"/>
+    <line x1="164" y1="50" x2="100" y2="90"/>
+    <line x1="36" y1="150" x2="100" y2="90"/>
+    <line x1="164" y1="150" x2="100" y2="90"/>
+    <line x1="36" y1="50" x2="36" y2="150"/>
+    <line x1="164" y1="50" x2="164" y2="150"/>
+  </g>
+  <g>
+    <polygon points="100,40 50,70 100,100 150,70" fill="#3B4148"/>
+    <polygon points="50,70 50,130 100,160 100,100" fill="#F59E0B"/>
+    <polygon points="150,70 150,130 100,160 100,100" fill="#374151"/>
+    <polygon points="100,40 50,70 100,100 150,70" stroke="#1F2933" stroke-width="3" fill="none"/>
+    <polygon points="50,70 50,130 100,160 100,100" stroke="#1F2933" stroke-width="3" fill="none"/>
+    <polygon points="150,70 150,130 100,160 100,100" stroke="#1F2933" stroke-width="3" fill="none"/>
+  </g>
+  <g fill="#1F2933">
+    <circle cx="36" cy="50" r="6"/>
+    <circle cx="164" cy="50" r="6"/>
+    <circle cx="36" cy="150" r="6"/>
+    <circle cx="164" cy="150" r="6"/>
+    <circle cx="100" cy="90" r="7"/>
+  </g>
+</svg>
diff --git a/gitapp-callback/templates/error.html b/gitapp-callback/templates/error.html
index 0317807e..ce7443c9 100644
--- a/gitapp-callback/templates/error.html
+++ b/gitapp-callback/templates/error.html
@@ -38,6 +38,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -158,12 +168,11 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
-                <li><a href="/registrations">Repository Registration</a></li>
-                <li><a href="#">My Repositories</a></li>
-                <li><a href="#">Settings</a></li>
-                <li><a href="#">Documentation</a></li>
+                <li><a href="/registrations?installation_id={{ installation_id }}&setup_action=update">Repository Registration</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
     </aside>
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index f3515397..8fd923dc 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -38,6 +38,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -225,6 +235,21 @@
             text-decoration: underline;
         }
 
+        .link-button {
+            background: none;
+            border: none;
+            color: #2563eb;
+            cursor: pointer;
+            font-size: 0.9rem;
+            font-weight: 500;
+            padding: 0;
+            text-decoration: underline;
+        }
+
+        .link-button:hover {
+            color: #1d4ed8;
+        }
+
         /* Alert Messages */
         .alert {
             padding: 1rem;
@@ -255,41 +280,105 @@
             color: #1e40af;
         }
 
-        /* Installation ID Badge */
-        .installation-badge {
-            display: inline-flex;
-            align-items: center;
-            padding: 0.5rem 1rem;
-            background-color: #eff6ff;
-            border: 1px solid #bfdbfe;
+        /* Installation Summary */
+        .summary-card {
+            background: #ffffff;
+            border-radius: 12px;
+            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.08);
+            padding: 1.5rem;
+            margin-bottom: 1.5rem;
+            border: 1px solid #e2e8f0;
+        }
+
+        .summary-card h3 {
+            color: #1e293b;
+            font-size: 1.1rem;
+            font-weight: 600;
+            margin-bottom: 0.75rem;
+        }
+
+        .summary-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+            gap: 1rem;
+        }
+
+        .summary-item {
+            background: #f8fafc;
             border-radius: 8px;
-            margin-bottom: 1rem;
+            padding: 0.75rem 1rem;
+            border: 1px solid #e2e8f0;
         }
 
-        .installation-badge strong {
-            margin-right: 0.5rem;
-            color: #1e40af;
+        .summary-item span {
+            display: block;
+            font-size: 0.8rem;
+            text-transform: uppercase;
+            letter-spacing: 0.04em;
+            color: #64748b;
+            margin-bottom: 0.35rem;
         }
 
-        .installation-badge code {
-            background-color: #dbeafe;
-            padding: 0.25rem 0.5rem;
+        .summary-item strong {
+            color: #0f172a;
+            font-weight: 600;
+        }
+
+        .summary-item code {
+            background-color: #e2e8f0;
+            padding: 0.15rem 0.4rem;
             border-radius: 4px;
             font-family: 'Courier New', monospace;
             font-size: 0.9rem;
         }
+
+        .summary-actions {
+            margin-top: 1rem;
+            display: flex;
+            flex-wrap: wrap;
+            gap: 0.75rem;
+            align-items: center;
+        }
+
+        .pill {
+            display: inline-flex;
+            align-items: center;
+            gap: 0.35rem;
+            font-size: 0.85rem;
+            color: #1e40af;
+            background-color: #eff6ff;
+            border: 1px solid #bfdbfe;
+            padding: 0.35rem 0.7rem;
+            border-radius: 999px;
+        }
+
+        .subtle-link {
+            color: #2563eb;
+            text-decoration: none;
+            font-weight: 500;
+        }
+
+        .subtle-link:hover {
+            text-decoration: underline;
+        }
+
+        .step-list {
+            margin-top: 0.75rem;
+            padding-left: 1.25rem;
+            color: #475569;
+            line-height: 1.6;
+        }
     </style>
 </head>
 <body>
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="#" class="active">Repository Registration</a></li>
-                <li><a href="#">My Repositories</a></li>
-                <li><a href="#">Settings</a></li>
-                <li><a href="#">Documentation</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
     </aside>
@@ -299,12 +388,41 @@ <h1>{{ github_app_name }}</h1>
         <div class="container">
             <div class="header">
                 <h2>Complete Repository Registration</h2>
-                <p>Configure your repository settings to get started with Argo Workflows.</p>
+                <p>Configure one repository at a time. The GitHub App installation can include multiple repositories.</p>
             </div>
 
-            <div class="installation-badge">
-                <strong>Installation ID:</strong>
-                <code>{{ installation_id }}</code>
+            <div class="summary-card">
+                <h3>Installation Overview</h3>
+                <div class="summary-grid">
+                    <div class="summary-item">
+                        <span>Installation</span>
+                        <strong><code>{{ installation_id }}</code></strong>
+                    </div>
+                    <div class="summary-item">
+                        <span>Repository Count</span>
+                        <strong>{{ repository_count }}</strong>
+                    </div>
+                    <div class="summary-item">
+                        <span>Current Repository</span>
+                        <strong>{{ selected_repository or "Not selected" }}</strong>
+                    </div>
+                </div>
+                <div class="summary-actions">
+                    <span class="pill">Changes to repo access happen in GitHub</span>
+                    <a class="subtle-link" href="https://github.com/settings/installations" target="_blank" rel="noopener noreferrer">
+                        Manage app installation
+                    </a>
+                    {% if multiple_repositories %}
+                    <a class="subtle-link" href="/registrations?installation_id={{ installation_id }}&setup_action={{ setup_action }}">
+                        Change repository
+                    </a>
+                    {% endif %}
+                </div>
+                <ol class="step-list">
+                    <li>Select the repository you want to configure.</li>
+                    <li>Provide bucket and access settings for this repository.</li>
+                    <li>Repeat for any additional repositories in this installation.</li>
+                </ol>
             </div>
 
             {% if setup_action == 'update' %}
@@ -312,12 +430,40 @@ <h2>Complete Repository Registration</h2>
                 You are updating an existing installation. Review and update your settings below.
             </div>
             {% endif %}
+            {% if setup_action == 'update' and creating_missing_registration %}
+            <div class="alert alert-info show">
+                No existing registration was found for this repository. Submitting this form will create it.
+            </div>
+            {% endif %}
+            {% if setup_action == 'install' and multiple_repositories %}
+            <div class="alert alert-info show">
+                This installation has multiple repositories. Each repository must be registered separately.
+            </div>
+            {% endif %}
 
             <div id="alertContainer"></div>
 
             <form id="registrationForm" method="POST" action="/registrations">
                 <input type="hidden" name="installation_id" value="{{ installation_id }}">
 
+                {% if selected_repository %}
+                <input type="hidden" name="selected_repository" value="{{ selected_repository }}">
+                <div class="form-group">
+                    <label for="selected_repository_display">Repository</label>
+                    <input
+                        type="text"
+                        id="selected_repository_display"
+                        value="{{ selected_repository }}"
+                        readonly
+                    >
+                </div>
+                {% else %}
+                <div class="alert alert-error">
+                    <p>No repositories found for this installation.</p>
+                </div>
+                {% endif %}
+
+
                 <div class="card">
                     <h3>Repository Configuration</h3>
 
@@ -340,110 +486,121 @@ <h3>Repository Configuration</h3>
                     <h3>Data Bucket Configuration</h3>
                     <p class="help-text" style="margin-bottom: 1.5rem;">S3-compatible bucket for storing workflow data (optional)</p>
 
-                    <div class="form-group">
-                        <label for="dataBucket_bucket">
-                            Bucket Name
-                        </label>
-                        <input
-                            type="text"
-                            id="dataBucket_bucket"
-                            name="dataBucket_bucket"
-                            placeholder="my-data-bucket"
-                            value="{{ initial_data.dataBucket.bucket if initial_data and initial_data.dataBucket else '' }}"
-                        >
+                    {% set data_bucket_has_secret = initial_data and initial_data.dataBucketCreatedTime %}
+                    {% if data_bucket_has_secret %}
+                    <div class="alert alert-info show bucket-notice">
+                        This bucket information was saved on {{ initial_data.dataBucketCreatedTime }}.
+                        <button type="button" class="link-button bucket-reentry-toggle" data-target="dataBucketForm">
+                            Click here to re-enter.
+                        </button>
                     </div>
+                    {% endif %}
 
-                    <div id="dataBucketFields" style="display: none;">
-                        <div class="form-group">
-                            <label for="dataBucket_accessKey">
-                                Access Key <span class="required">*</span>
-                            </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="dataBucket_accessKey"
-                                    name="dataBucket_accessKey"
-                                    placeholder="AKIAIOSFODNN7EXAMPLE"
-                                    value="{{ initial_data.dataBucket.accessKey if initial_data and initial_data.dataBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="dataBucket_accessKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
-                        </div>
-
+                    <div id="dataBucketForm" {% if data_bucket_has_secret %}style="display: none;"{% endif %}>
                         <div class="form-group">
-                            <label for="dataBucket_secretKey">
-                                Secret Key <span class="required">*</span>
+                            <label for="dataBucket_bucket">
+                                Bucket Name
                             </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="dataBucket_secretKey"
-                                    name="dataBucket_secretKey"
-                                    placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-                                    value="{{ initial_data.dataBucket.secretKey if initial_data and initial_data.dataBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="dataBucket_secretKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
+                            <input
+                                type="text"
+                                id="dataBucket_bucket"
+                                name="dataBucket_bucket"
+                                placeholder="my-data-bucket"
+                                value=""
+                            >
                         </div>
 
-                        <div class="form-group">
-                            <label>
-                                <input
-                                    type="checkbox"
-                                    id="dataBucket_is_aws"
-                                    name="dataBucket_is_aws"
-                                    {% if not initial_data or not initial_data.dataBucket or initial_data.dataBucket.is_aws %}checked{% endif %}
-                                >
-                                Is AWS S3
-                            </label>
-                            <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
-                        </div>
-
-                        <div id="dataBucketNonAwsFields" style="display: none;">
+                        <div id="dataBucketFields" style="display: none;">
                             <div class="form-group">
-                                <label for="dataBucket_hostname">
-                                    Hostname <span class="required">*</span>
+                                <label for="dataBucket_accessKey">
+                                    Access Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="url"
-                                    id="dataBucket_hostname"
-                                    name="dataBucket_hostname"
-                                    placeholder="https://minio.example.org:9000"
-                                    value="{{ initial_data.dataBucket.hostname if initial_data and initial_data.dataBucket else '' }}"
-                                >
-                                <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="dataBucket_accessKey"
+                                        name="dataBucket_accessKey"
+                                        placeholder="AKIAIOSFODNN7EXAMPLE"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="dataBucket_accessKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
-                                <label for="dataBucket_region">
-                                    Region <span class="required">*</span>
+                                <label for="dataBucket_secretKey">
+                                    Secret Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="text"
-                                    id="dataBucket_region"
-                                    name="dataBucket_region"
-                                    placeholder="us-west-2"
-                                    value="{{ initial_data.dataBucket.region if initial_data and initial_data.dataBucket else '' }}"
-                                >
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="dataBucket_secretKey"
+                                        name="dataBucket_secretKey"
+                                        placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="dataBucket_secretKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
                                 <label>
                                     <input
                                         type="checkbox"
-                                        id="dataBucket_pathStyle"
-                                        name="dataBucket_pathStyle"
-                                        {% if initial_data and initial_data.dataBucket and initial_data.dataBucket.pathStyle %}checked{% endif %}
+                                        id="dataBucket_is_aws"
+                                        name="dataBucket_is_aws"
+                                        checked
                                     >
-                                    Use Path-Style Requests
+                                    Is AWS S3
                                 </label>
-                                <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
+                            </div>
+
+                            <div id="dataBucketNonAwsFields" style="display: none;">
+                                <div class="form-group">
+                                    <label for="dataBucket_hostname">
+                                        Hostname <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="url"
+                                        id="dataBucket_hostname"
+                                        name="dataBucket_hostname"
+                                        placeholder="https://minio.example.org:9000"
+                                        value=""
+                                    >
+                                    <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                </div>
+
+                                <div class="form-group">
+                                    <label for="dataBucket_region">
+                                        Region <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="text"
+                                        id="dataBucket_region"
+                                        name="dataBucket_region"
+                                        placeholder="us-west-2"
+                                        value=""
+                                    >
+                                </div>
+
+                                <div class="form-group">
+                                    <label>
+                                        <input
+                                            type="checkbox"
+                                            id="dataBucket_pathStyle"
+                                            name="dataBucket_pathStyle"
+                                        >
+                                        Use Path-Style Requests
+                                    </label>
+                                    <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                </div>
                             </div>
                         </div>
                     </div>
@@ -453,110 +610,121 @@ <h3>Data Bucket Configuration</h3>
                     <h3>Artifact Bucket Configuration</h3>
                     <p class="help-text" style="margin-bottom: 1.5rem;">S3-compatible bucket for storing workflow artifacts (optional)</p>
 
-                    <div class="form-group">
-                        <label for="artifactBucket_bucket">
-                            Bucket Name
-                        </label>
-                        <input
-                            type="text"
-                            id="artifactBucket_bucket"
-                            name="artifactBucket_bucket"
-                            placeholder="my-artifact-bucket"
-                            value="{{ initial_data.artifactBucket.bucket if initial_data and initial_data.artifactBucket else '' }}"
-                        >
+                    {% set artifact_bucket_has_secret = initial_data and initial_data.artifactBucketCreatedTime %}
+                    {% if artifact_bucket_has_secret %}
+                    <div class="alert alert-info show bucket-notice">
+                        This bucket information was saved on {{ initial_data.artifactBucketCreatedTime }}.
+                        <button type="button" class="link-button bucket-reentry-toggle" data-target="artifactBucketForm">
+                            Click here to re-enter.
+                        </button>
                     </div>
+                    {% endif %}
 
-                    <div id="artifactBucketFields" style="display: none;">
+                    <div id="artifactBucketForm" {% if artifact_bucket_has_secret %}style="display: none;"{% endif %}>
                         <div class="form-group">
-                            <label for="artifactBucket_accessKey">
-                                Access Key <span class="required">*</span>
+                            <label for="artifactBucket_bucket">
+                                Bucket Name
                             </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="artifactBucket_accessKey"
-                                    name="artifactBucket_accessKey"
-                                    placeholder="AKIAIOSFODNN7EXAMPLE"
-                                    value="{{ initial_data.artifactBucket.accessKey if initial_data and initial_data.artifactBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="artifactBucket_accessKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
+                            <input
+                                type="text"
+                                id="artifactBucket_bucket"
+                                name="artifactBucket_bucket"
+                                placeholder="my-artifact-bucket"
+                                value=""
+                            >
                         </div>
 
-                        <div class="form-group">
-                            <label for="artifactBucket_secretKey">
-                                Secret Key <span class="required">*</span>
-                            </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="artifactBucket_secretKey"
-                                    name="artifactBucket_secretKey"
-                                    placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-                                    value="{{ initial_data.artifactBucket.secretKey if initial_data and initial_data.artifactBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="artifactBucket_secretKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
-                        </div>
-
-                        <div class="form-group">
-                            <label>
-                                <input
-                                    type="checkbox"
-                                    id="artifactBucket_is_aws"
-                                    name="artifactBucket_is_aws"
-                                    {% if not initial_data or not initial_data.artifactBucket or initial_data.artifactBucket.is_aws %}checked{% endif %}
-                                >
-                                Is AWS S3
-                            </label>
-                            <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
-                        </div>
-
-                        <div id="artifactBucketNonAwsFields" style="display: none;">
+                        <div id="artifactBucketFields" style="display: none;">
                             <div class="form-group">
-                                <label for="artifactBucket_hostname">
-                                    Hostname <span class="required">*</span>
+                                <label for="artifactBucket_accessKey">
+                                    Access Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="url"
-                                    id="artifactBucket_hostname"
-                                    name="artifactBucket_hostname"
-                                    placeholder="https://minio.example.org:9000"
-                                    value="{{ initial_data.artifactBucket.hostname if initial_data and initial_data.artifactBucket else '' }}"
-                                >
-                                <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="artifactBucket_accessKey"
+                                        name="artifactBucket_accessKey"
+                                        placeholder="AKIAIOSFODNN7EXAMPLE"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="artifactBucket_accessKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
-                                <label for="artifactBucket_region">
-                                    Region <span class="required">*</span>
+                                <label for="artifactBucket_secretKey">
+                                    Secret Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="text"
-                                    id="artifactBucket_region"
-                                    name="artifactBucket_region"
-                                    placeholder="us-west-2"
-                                    value="{{ initial_data.artifactBucket.region if initial_data and initial_data.artifactBucket else '' }}"
-                                >
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="artifactBucket_secretKey"
+                                        name="artifactBucket_secretKey"
+                                        placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="artifactBucket_secretKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
                                 <label>
                                     <input
                                         type="checkbox"
-                                        id="artifactBucket_pathStyle"
-                                        name="artifactBucket_pathStyle"
-                                        {% if initial_data and initial_data.artifactBucket and initial_data.artifactBucket.pathStyle %}checked{% endif %}
+                                        id="artifactBucket_is_aws"
+                                        name="artifactBucket_is_aws"
+                                        checked
                                     >
-                                    Use Path-Style Requests
+                                    Is AWS S3
                                 </label>
-                                <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
+                            </div>
+
+                            <div id="artifactBucketNonAwsFields" style="display: none;">
+                                <div class="form-group">
+                                    <label for="artifactBucket_hostname">
+                                        Hostname <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="url"
+                                        id="artifactBucket_hostname"
+                                        name="artifactBucket_hostname"
+                                        placeholder="https://minio.example.org:9000"
+                                        value=""
+                                    >
+                                    <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                </div>
+
+                                <div class="form-group">
+                                    <label for="artifactBucket_region">
+                                        Region <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="text"
+                                        id="artifactBucket_region"
+                                        name="artifactBucket_region"
+                                        placeholder="us-west-2"
+                                        value=""
+                                    >
+                                </div>
+
+                                <div class="form-group">
+                                    <label>
+                                        <input
+                                            type="checkbox"
+                                            id="artifactBucket_pathStyle"
+                                            name="artifactBucket_pathStyle"
+                                        >
+                                        Use Path-Style Requests
+                                    </label>
+                                    <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                </div>
                             </div>
                         </div>
                     </div>
@@ -624,6 +792,20 @@ <h3>Access Control</h3>
             });
         });
 
+        document.querySelectorAll('.bucket-reentry-toggle').forEach(button => {
+            button.addEventListener('click', function() {
+                const targetId = this.getAttribute('data-target');
+                const target = document.getElementById(targetId);
+                if (target) {
+                    target.style.display = 'block';
+                }
+                const notice = this.closest('.bucket-notice');
+                if (notice) {
+                    notice.style.display = 'none';
+                }
+            });
+        });
+
         // Show/hide bucket credential fields when bucket name is entered
         function setupBucketFieldToggle(bucketPrefix) {
             const bucketInput = document.getElementById(`${bucketPrefix}_bucket`);
diff --git a/gitapp-callback/templates/select_repository.html b/gitapp-callback/templates/select_repository.html
new file mode 100644
index 00000000..fdc78117
--- /dev/null
+++ b/gitapp-callback/templates/select_repository.html
@@ -0,0 +1,282 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Select Repository - {{ github_app_name }}</title>
+    <style>
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+            background-color: #f5f7fa;
+            color: #475569;
+            min-height: 100vh;
+            display: flex;
+        }
+
+        .sidebar {
+            width: 250px;
+            background-color: #1e293b;
+            color: #e2e8f0;
+            padding: 2rem 0;
+            position: fixed;
+            height: 100vh;
+            overflow-y: auto;
+        }
+
+        .sidebar h1 {
+            color: #ffffff;
+            font-size: 1.5rem;
+            padding: 0 1.5rem;
+            margin-bottom: 2rem;
+            font-weight: 600;
+        }
+
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
+        .sidebar nav ul {
+            list-style: none;
+        }
+
+        .sidebar nav li {
+            margin: 0.25rem 0;
+        }
+
+        .sidebar nav a {
+            display: block;
+            padding: 0.75rem 1.5rem;
+            color: #cbd5e1;
+            text-decoration: none;
+            transition: background-color 0.2s, color 0.2s;
+        }
+
+        .sidebar nav a:hover,
+        .sidebar nav a.active {
+            background-color: #334155;
+            color: #ffffff;
+        }
+
+        .main-content {
+            margin-left: 250px;
+            flex: 1;
+            padding: 2rem;
+        }
+
+        .container {
+            max-width: 800px;
+            margin: 0 auto;
+        }
+
+        .header {
+            margin-bottom: 2rem;
+        }
+
+        .header h2 {
+            color: #1e293b;
+            font-size: 1.75rem;
+            font-weight: 600;
+            margin-bottom: 0.5rem;
+        }
+
+        .card {
+            background-color: #ffffff;
+            border-radius: 0.75rem;
+            padding: 2rem;
+            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
+        }
+
+        .summary {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+            gap: 1rem;
+            margin-bottom: 1.5rem;
+        }
+
+        .summary-item {
+            background: #f8fafc;
+            border-radius: 0.5rem;
+            border: 1px solid #e2e8f0;
+            padding: 0.75rem 1rem;
+        }
+
+        .summary-item span {
+            display: block;
+            font-size: 0.8rem;
+            text-transform: uppercase;
+            color: #64748b;
+            letter-spacing: 0.04em;
+            margin-bottom: 0.35rem;
+        }
+
+        .summary-item strong {
+            color: #0f172a;
+        }
+
+        .callout {
+            padding: 1rem;
+            border-radius: 0.75rem;
+            border: 1px solid #bfdbfe;
+            background-color: #eff6ff;
+            color: #1e3a8a;
+            margin-bottom: 1.5rem;
+        }
+
+        .callout a {
+            color: #1d4ed8;
+            font-weight: 600;
+            text-decoration: none;
+        }
+
+        .callout a:hover {
+            text-decoration: underline;
+        }
+
+        .form-group {
+            margin-bottom: 1.5rem;
+        }
+
+        label {
+            display: block;
+            margin-bottom: 0.5rem;
+            font-weight: 500;
+            color: #1e293b;
+        }
+
+        select {
+            width: 100%;
+            padding: 0.75rem 1rem;
+            border: 1px solid #cbd5e1;
+            border-radius: 0.5rem;
+            font-size: 0.95rem;
+            color: #1e293b;
+            background-color: #ffffff;
+        }
+
+        .search-input {
+            width: 100%;
+            padding: 0.65rem 0.9rem;
+            border: 1px solid #cbd5e1;
+            border-radius: 0.5rem;
+            font-size: 0.95rem;
+            margin-bottom: 0.75rem;
+        }
+
+        .button {
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            padding: 0.75rem 1.5rem;
+            border-radius: 0.5rem;
+            border: none;
+            font-weight: 600;
+            cursor: pointer;
+            transition: background-color 0.2s, transform 0.1s;
+            background-color: #2563eb;
+            color: #ffffff;
+        }
+
+        .button:hover {
+            background-color: #1d4ed8;
+        }
+    </style>
+</head>
+<body>
+    <aside class="sidebar">
+        <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
+        <nav>
+            <ul>
+                <li><a href="#" class="active">Repository Registration</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
+            </ul>
+        </nav>
+    </aside>
+
+    <main class="main-content">
+        <div class="container">
+            <div class="header">
+                <h2>Select Repository</h2>
+                {% if setup_action == "install" %}
+                <p>Select a repository to register. You'll need to repeat this for each repository.</p>
+            {% else %}
+            <p>Choose the repository you want to update before continuing.</p>
+            {% endif %}
+        </div>
+
+        <div class="card">
+            <div class="summary">
+                <div class="summary-item">
+                    <span>Installation ID</span>
+                    <strong>{{ installation_id }}</strong>
+                </div>
+                <div class="summary-item">
+                    <span>Repositories Available</span>
+                    <strong>{{ repositories | length }}</strong>
+                </div>
+            </div>
+
+            <div class="callout">
+                Add or remove repositories for this installation in GitHub.
+                <a href="https://github.com/settings/installations" target="_blank" rel="noopener noreferrer">
+                    Manage app installation
+                </a>
+            </div>
+
+            <form method="GET" action="/registrations">
+                <input type="hidden" name="installation_id" value="{{ installation_id }}">
+                <input type="hidden" name="setup_action" value="{{ setup_action }}">
+
+                <div class="form-group">
+                    <label for="selected_repository">Repository *</label>
+                    <input
+                        type="text"
+                        class="search-input"
+                        id="repoSearch"
+                        placeholder="Filter repositories..."
+                        aria-label="Filter repositories"
+                    >
+                    <select id="selected_repository" name="selected_repository" required>
+                        <option value="">Select a repository...</option>
+                        {% for repo in repositories %}
+                        <option value="{{ repo.full_name }}">{{ repo.full_name }}</option>
+                            {% endfor %}
+                        </select>
+                    </div>
+
+            <button type="submit" class="button">Continue</button>
+        </form>
+    </div>
+</div>
+</main>
+
+<script>
+    const repoSearch = document.getElementById('repoSearch');
+    const repoSelect = document.getElementById('selected_repository');
+
+    repoSearch.addEventListener('input', function() {
+        const query = this.value.toLowerCase();
+        Array.from(repoSelect.options).forEach(option => {
+            if (!option.value) {
+                option.hidden = false;
+                return;
+            }
+            const matches = option.value.toLowerCase().includes(query);
+            option.hidden = !matches;
+        });
+    });
+</script>
+</body>
+</html>
diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index 9feb3d49..f5a6cfb8 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -38,6 +38,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -122,6 +132,27 @@
             margin: 2rem 0;
         }
 
+        .next-steps {
+            background-color: #eff6ff;
+            border: 1px solid #bfdbfe;
+            color: #1e3a8a;
+            border-radius: 8px;
+            padding: 1.25rem;
+            margin-bottom: 1.5rem;
+            text-align: left;
+        }
+
+        .next-steps h3 {
+            font-size: 1rem;
+            margin-bottom: 0.5rem;
+            color: #1e3a8a;
+        }
+
+        .next-steps ul {
+            padding-left: 1.25rem;
+            line-height: 1.6;
+        }
+
         .config-summary h3 {
             color: #334155;
             font-size: 1rem;
@@ -196,12 +227,11 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
-                <li><a href="/registrations">Repository Registration</a></li>
-                <li><a href="#">My Repositories</a></li>
-                <li><a href="#">Settings</a></li>
-                <li><a href="#">Documentation</a></li>
+                <li><a href="/registrations?installation_id={{ config.installation_id }}&setup_action=update">Repository Registration</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
     </aside>
@@ -217,7 +247,15 @@ <h1>{{ github_app_name }}</h1>
                 </div>
 
                 <h2>Registration Complete!</h2>
-                <p>Your repository has been successfully registered with Argo Workflows.</p>
+                <p>Your repository has been successfully registered.</p>
+
+                <div class="next-steps">
+                    <h3>What’s next</h3>
+                    <ul>
+                        <li>Repeat the registration flow for any other repositories in this installation.</li>
+                        <li>When you add or remove repositories in GitHub, return here to update the configuration.</li>
+                    </ul>
+                </div>
 
                 <div class="config-summary">
                     <h3>Configuration Summary</h3>
@@ -227,6 +265,11 @@ <h3>Configuration Summary</h3>
                         <span class="config-value"><code>{{ config.installation_id }}</code></span>
                     </div>
 
+                    <div class="config-item">
+                        <span class="config-label">Repository:</span>
+                        <span class="config-value"><code>{{ config.full_name }}</code></span>
+                    </div>
+
                     <div class="config-item">
                         <span class="config-label">Default Branch:</span>
                         <span class="config-value"><code>{{ config.defaultBranch }}</code></span>
@@ -274,7 +317,12 @@ <h3>Configuration Summary</h3>
                 </div>
 
                 <div>
-                    <a href="https://github.com" class="btn btn-primary">Go to GitHub</a>
+                    <a href="/registrations?installation_id={{ config.installation_id }}&setup_action=update" class="btn btn-primary">
+                        Register another repository
+                    </a>
+                    <a href="https://github.com/settings/installations" class="btn btn-secondary" target="_blank" rel="noopener noreferrer">
+                        Manage app installation
+                    </a>
                 </div>
             </div>
         </div>
diff --git a/gitapp-callback/tests/test_app.py b/gitapp-callback/tests/test_app.py
index f4daa0f1..47851a88 100644
--- a/gitapp-callback/tests/test_app.py
+++ b/gitapp-callback/tests/test_app.py
@@ -16,6 +16,9 @@
 
 from app import app, init_db
 
+TEST_REPO = {"full_name": "octo/widgets", "html_url": "https://github.com/octo/widgets"}
+TEST_REPO_ALT = {"full_name": "octo/alternate", "html_url": "https://github.com/octo/alternate"}
+
 
 @pytest.fixture
 def client():
@@ -73,13 +76,15 @@ def test_registrations_form_with_update_action(client):
     # Create existing registration first
     existing_data = {
         'installation_id': '12345678',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO['full_name'],
         'defaultBranch': 'main',
         'adminUsers': ['admin@example.com'],
         'readUsers': [],
         'dataBucket': None,
         'artifactBucket': None
     }
-    save_registration('12345678', existing_data)
+    save_registration('12345678', existing_data, repositories=[TEST_REPO])
     
     # Now access update form
     response = client.get('/registrations?installation_id=12345678&setup_action=update')
@@ -310,7 +315,7 @@ def test_database_persistence_install(client):
     assert json_data['success'] is True
     
     # Verify it was saved to database
-    saved_data = get_registration('test-install-123')
+    saved_data = get_registration('test-install-123', repository=TEST_REPO)
     assert saved_data is not None
     assert saved_data['installation_id'] == 'test-install-123'
     assert saved_data['defaultBranch'] == 'develop'
@@ -324,13 +329,15 @@ def test_database_persistence_update(client):
     # Create initial registration
     initial_data = {
         'installation_id': 'test-update-456',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO['full_name'],
         'defaultBranch': 'main',
         'adminUsers': ['admin@example.com'],
         'readUsers': [],
         'dataBucket': None,
         'artifactBucket': None
     }
-    save_registration('test-update-456', initial_data)
+    save_registration('test-update-456', initial_data, repositories=[TEST_REPO])
     
     # Update the registration
     response = client.post('/registrations', data={
@@ -344,7 +351,7 @@ def test_database_persistence_update(client):
     assert json_data['success'] is True
     
     # Verify the update
-    updated_data = get_registration('test-update-456')
+    updated_data = get_registration('test-update-456', repository=TEST_REPO)
     assert updated_data is not None
     assert updated_data['defaultBranch'] == 'production'
     assert len(updated_data['adminUsers']) == 2
@@ -357,13 +364,15 @@ def test_install_with_existing_registration_redirects(client):
     # Create existing registration
     existing_data = {
         'installation_id': '78900001',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO['full_name'],
         'defaultBranch': 'main',
         'adminUsers': ['admin@example.com'],
         'readUsers': [],
         'dataBucket': None,
         'artifactBucket': None
     }
-    save_registration('78900001', existing_data)
+    save_registration('78900001', existing_data, repositories=[TEST_REPO])
     
     # Try to access install form (should get error/redirect)
     response = client.get('/registrations?installation_id=78900001&setup_action=install')
@@ -389,25 +398,21 @@ def test_update_form_prepopulates_data(client):
     # Create existing registration with bucket data
     existing_data = {
         'installation_id': '11100001',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO_ALT['full_name'],
         'defaultBranch': 'staging',
-        'dataBucket': {
-            'bucket': 'my-data',
-            'accessKey': 'AKIATEST',
-            'secretKey': 'secretTest123',
-            'is_aws': True
-        },
+        'dataBucket': None,
         'artifactBucket': None,
         'adminUsers': ['user1@example.com', 'user2@example.com'],
         'readUsers': ['viewer@example.com']
     }
-    save_registration('11100001', existing_data)
+    save_registration('11100001', existing_data, repositories=[TEST_REPO_ALT])
     
     # Access update form
     response = client.get('/registrations?installation_id=11100001&setup_action=update')
     
     assert response.status_code == 200
     assert b'staging' in response.data
-    assert b'my-data' in response.data
     assert b'user1@example.com' in response.data
     assert b'user2@example.com' in response.data
     assert b'viewer@example.com' in response.data
diff --git a/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml b/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml
index 3e89c6c6..20f1be43 100644
--- a/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml
+++ b/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml
@@ -168,10 +168,10 @@ ingressAuthzOverlay:
     # GitHubb Callback for Repository Registrations
     registrations:
       enabled: true
-      namespace: security
+      namespace: argocd
       service: gitapp-callback
       # Service is in same namespace as ingress
-      serviceNamespace: security
+      serviceNamespace: argocd
       port: 8080
       pathPrefix: /registrations
         
diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 9302b05c..e1bccc16 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: gitapp-callback
-  namespace: {{ .Values.namespaces.security }}
+  namespace: {{ .Values.namespaces.argocd }}
   labels:
     app: gitapp-callback
     app.kubernetes.io/name: gitapp-callback
@@ -12,6 +12,9 @@ metadata:
   annotations:
     meta.helm.sh/release-name: {{ .Release.Name }}
     meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+    # Run with Deployment after ExternalSecrets
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "5"    
 spec:
   replicas: {{ .Values.gitappCallback.replicas }}
   selector:
@@ -22,34 +25,113 @@ spec:
       labels:
         app: gitapp-callback
     spec:
+      # Init container to wait for the secret to be created
+      # This is useful when the secret is managed by external-secrets/vault
+      initContainers:
+      - name: gitapp-callback-wait-for-secret
+        image: busybox:1.36
+        command:
+        - sh
+        - -c
+        - |
+          echo "Waiting for secret {{ .Values.githubStatusProxy.privateKeySecret.name }} to be available..."
+          until [ -f /etc/github/private-key.pem ]; do
+            echo "Secret not found, waiting..."
+            sleep 2
+          done
+          echo "Secret found, proceeding with startup"
+        volumeMounts:
+        - name: github-app-key
+          mountPath: /etc/github
+          readOnly: true
+      # Init container to configure git credentials securely
+      - name: gitapp-callback-git-credentials
+        image: alpine/git:2.43.0
+        command:
+        - sh
+        - -c
+        - |
+          set -e
+          if [ -z "$GIT_USERNAME" ] || [ -z "$GIT_PAT" ]; then
+            echo "GIT_USERNAME or GIT_PAT not set"
+            exit 1
+          fi
+          mkdir -p /gitcreds
+          CRED_STRING="https://${GIT_USERNAME}:${GIT_PAT}@github.com"
+          echo "${CRED_STRING}" > /gitcreds/.git-credentials
+        env:
+        - name: GIT_USERNAME
+          value: {{ .Values.gitappCallback.githubUserName }}
+        - name: GIT_PAT
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+              key: {{ .Values.gitappCallback.githubTokenSecret.key }}
+        volumeMounts:
+        - name: git-credentials
+          mountPath: /gitcreds
+
+
       containers:
       - name: gitapp-callback
         image: "{{ .Values.gitappCallback.image.repository }}:{{ .Values.gitappCallback.image.tag }}"
         imagePullPolicy: "{{ .Values.gitappCallback.image.pullPolicy }}"
         env:
+        # Environment variables for GitApp Callback
+        - name: GITHUB_APP_ID
+          value: {{ .Values.githubApp.appId | quote }}
+        - name: GITHUB_PRIVATE_KEY_PATH
+          value: /etc/github/private-key.pem
         - name: SECRET_KEY
           value: {{ .Values.gitappCallback.secretKey | quote }}
+        # for UI
         - name: GITHUB_APP_NAME
           value: {{ .Values.gitappCallback.githubAppName | quote }}
+        # for persistence
         - name: DB_PATH
           value: "/var/registrations/registrations.sqlite"
+        - name: VAULT_ADDR
+          value: {{ .Values.gitappCallback.vault.addr | quote }}
+        - name: VAULT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.gitappCallback.vault.tokenSecret.name }}
+              key: {{ .Values.gitappCallback.vault.tokenSecret.key }}
+        - name: GITHUB_PAT
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+              key: {{ .Values.gitappCallback.githubTokenSecret.key }}
+        - name: GIT_USERNAME
+          value: {{ .Values.gitappCallback.githubUserName }}
+        - name: REPO_REGISTRATION
+          value: {{ .Values.gitappCallback.githubRepoUrl | quote }}
+        - name: GIT_CREDENTIALS_FILE
+          value: /root/.git-credentials
+
         ports:
         - containerPort: 8080
         volumeMounts:
         - name: registrations-data
           mountPath: /var/registrations
+        - name: github-app-key
+          mountPath: /etc/github
+          readOnly: true
+        - name: git-credentials
+          mountPath: /root
+
         livenessProbe:
           httpGet:
             path: /healthz
             port: 8080
           initialDelaySeconds: 5
-          periodSeconds: 10
+          periodSeconds: 30
         readinessProbe:
           httpGet:
             path: /healthz
             port: 8080
           initialDelaySeconds: 2
-          periodSeconds: 5
+          periodSeconds: 30
       volumes:
       - name: registrations-data
         {{- if and .Values.gitappCallback.persistence.enabled .Values.gitappCallback.persistence.useExtraMounts }}
@@ -64,12 +146,22 @@ spec:
         {{- else }}
         emptyDir: {}
         {{- end }}
+      - name: github-app-key
+        secret:
+          secretName: {{ .Values.githubStatusProxy.privateKeySecret.name }}
+          items:
+          - key: {{ .Values.githubStatusProxy.privateKeySecret.key }}
+            path: private-key.pem
+          optional: false
+      - name: git-credentials
+        emptyDir: {}
+          
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: gitapp-callback
-  namespace: {{ .Values.namespaces.security }}
+  namespace: {{ .Values.namespaces.argocd }}
   labels:
     app: gitapp-callback
     app.kubernetes.io/name: gitapp-callback
diff --git a/helm/argo-stack/templates/eso/externalsecret-github-app.yaml b/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
index 57c16aa8..f4740423 100644
--- a/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
+++ b/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
@@ -1,7 +1,7 @@
 {{- if and (include "argo-stack.vault.enabled" .) .Values.githubApp.enabled .Values.githubApp.privateKeyVaultPath }}
 {{- if .Capabilities.APIVersions.Has "external-secrets.io/v1/ClusterSecretStore" }}
 ---
-# ExternalSecret for GitHub App private key
+# ExternalSecret for GitHub App private key, issued by GitHub, stored in Vault
 # This secret is used by Argo CD for repository authentication via GitHub App
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -35,6 +35,42 @@ spec:
       remoteRef:
         key: {{ include "argo-stack.vault.extractKey" .Values.githubApp.privateKeyVaultPath }}
         property: {{ include "argo-stack.vault.extractProperty" .Values.githubApp.privateKeyVaultPath }}
+---
+# ExternalSecret for GitHub token used by GitApp Callback, to post RepoRegistration PR
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+  namespace: {{ .Values.namespaces.argocd }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "1"
+  labels:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/component: argocd
+    app.kubernetes.io/part-of: github-app-auth
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: {{ include "argo-stack.secretStore.kind" . }}
+    name: {{ include "argo-stack.secretStore.name" . }}
+  target:
+    name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+    creationPolicy: Owner
+    template:
+      type: Opaque
+      metadata:
+        labels:
+          app.kubernetes.io/part-of: argocd
+  data:
+    - secretKey: token
+      remoteRef:
+        key: {{ include "argo-stack.vault.extractKey" .Values.gitappCallback.githubTokenSecret.vaultPath }}
+        property: {{ include "argo-stack.vault.extractProperty" .Values.gitappCallback.githubTokenSecret.vaultPath  }}
+
 {{- end }}
 {{- end }}
 
+
diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index 94b8573e..ea61b852 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -268,20 +268,28 @@ landingPage:
 gitappCallback:
   # Enable the GitHub App callback service deployment
   enabled: true
+  # Git repository URL for storing repo registration data
+  # This repository contains declarative YAML files for each RepoRegistration
+  githubRepoUrl: "" 
+  githubUserName: ""
+  githubTokenSecret:
+    vaultPath: argo/events/github#token
+    name: github-reg-repo-token
+    key: token
   # Container image configuration
   image:
     repository: gitapp-callback
     tag: v1.0.0
     pullPolicy: IfNotPresent
   # Number of replicas
-  replicas: 2
+  replicas: 1
   # Flask secret key for session management
   # IMPORTANT: Override this in production with a secure random value
   # Recommended: Use Vault with External Secrets Operator
   # Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'
-  secretKey: "REPLACE_ME_WITH_SECURE_RANDOM_VALUE"
+  secretKey: ""
   # GitHub App name (displayed in the UI)
-  githubAppName: "calypr-workflows"
+  githubAppName: "calypr"
   # Persistence configuration for registration database
   persistence:
     # Enable persistent storage for SQLite database (uses PVC or host mount based on useExtraMounts)
@@ -302,7 +310,11 @@ gitappCallback:
     storageClass: ""
     # Storage size
     size: "10Mi" # Requests 10 Megabytes of storage
-
+  vault:
+    addr: "http://vault.vault.svc.cluster.local:8200"
+    tokenSecret:
+      name: "gitapp-vault-token"
+      key: "token"
 # ============================================================================
 # GitHub Status Proxy Settings
 # ============================================================================
@@ -313,7 +325,7 @@ githubStatusProxy:
     repository: github-status-proxy
     tag: latest
     pullPolicy: IfNotPresent  
-  replicas: 2
+  replicas: 1
   namespace: argocd
   # GitHub App configuration
   # The App ID can be found in your GitHub App settings