diff --git a/apis/actions.github.com/v1alpha1/appconfig/appconfig.go b/apis/actions.github.com/v1alpha1/appconfig/appconfig.go
index b8c31ca9..28179ae8 100644
--- a/apis/actions.github.com/v1alpha1/appconfig/appconfig.go
+++ b/apis/actions.github.com/v1alpha1/appconfig/appconfig.go
@@ -75,7 +75,7 @@ func FromSecret(secret *corev1.Secret) (*AppConfig, error) {
 	return cfg.tidy(), nil
 }
 
-func FromString(v string) (*AppConfig, error) {
+func FromJSONString(v string) (*AppConfig, error) {
 	var appConfig AppConfig
 	if err := json.NewDecoder(bytes.NewBufferString(v)).Decode(&appConfig); err != nil {
 		return nil, err
diff --git a/apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go b/apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go
index b410b16c..c9009bc6 100644
--- a/apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go
+++ b/apis/actions.github.com/v1alpha1/appconfig/appconfig_test.go
@@ -142,7 +142,7 @@ func TestAppConfigFromString_valid(t *testing.T) {
 			bytes, err := json.Marshal(cfg)
 			require.NoError(t, err)
 
-			got, err := FromString(string(bytes))
+			got, err := FromJSONString(string(bytes))
 			require.NoError(t, err)
 
 			want := cfg.tidy()
diff --git a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go
index fcbf38eb..ecb01b58 100644
--- a/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go
+++ b/apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go
@@ -72,9 +72,6 @@ type AutoscalingRunnerSetSpec struct {
 	// +optional
 	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
 
-	// +optional
-	VaultServerTLS *TLSConfig `json:"vaultServerTLS,omitempty"`
-
 	// +optional
 	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
 
diff --git a/apis/actions.github.com/v1alpha1/ephemeralrunner_types.go b/apis/actions.github.com/v1alpha1/ephemeralrunner_types.go
index 9381a84a..7667174f 100644
--- a/apis/actions.github.com/v1alpha1/ephemeralrunner_types.go
+++ b/apis/actions.github.com/v1alpha1/ephemeralrunner_types.go
@@ -102,6 +102,9 @@ type EphemeralRunnerSpec struct {
 	// +required
 	GitHubConfigSecret string `json:"githubConfigSecret,omitempty"`
 
+	// +optional
+	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
+
 	// +required
 	RunnerScaleSetId int `json:"runnerScaleSetId,omitempty"`
 
@@ -111,9 +114,6 @@ type EphemeralRunnerSpec struct {
 	// +optional
 	ProxySecretRef string `json:"proxySecretRef,omitempty"`
 
-	// +optional
-	GitHubServerTLS *TLSConfig `json:"githubServerTLS,omitempty"`
-
 	// +optional
 	VaultConfig *VaultConfig `json:"vaultConfig,omitempty"`
 
diff --git a/apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go b/apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go
index bebfed51..f50acc08 100644
--- a/apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go
@@ -217,11 +217,6 @@ func (in *AutoscalingRunnerSetSpec) DeepCopyInto(out *AutoscalingRunnerSetSpec)
 		*out = new(TLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.VaultServerTLS != nil {
-		in, out := &in.VaultServerTLS, &out.VaultServerTLS
-		*out = new(TLSConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.VaultConfig != nil {
 		in, out := &in.VaultConfig, &out.VaultConfig
 		*out = new(VaultConfig)
@@ -462,16 +457,16 @@ func (in *EphemeralRunnerSetStatus) DeepCopy() *EphemeralRunnerSetStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *EphemeralRunnerSpec) DeepCopyInto(out *EphemeralRunnerSpec) {
 	*out = *in
-	if in.Proxy != nil {
-		in, out := &in.Proxy, &out.Proxy
-		*out = new(ProxyConfig)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.GitHubServerTLS != nil {
 		in, out := &in.GitHubServerTLS, &out.GitHubServerTLS
 		*out = new(TLSConfig)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Proxy != nil {
+		in, out := &in.Proxy, &out.Proxy
+		*out = new(ProxyConfig)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.VaultConfig != nil {
 		in, out := &in.VaultConfig, &out.VaultConfig
 		*out = new(VaultConfig)
diff --git a/cmd/ghalistener/config/config.go b/cmd/ghalistener/config/config.go
index e76b9dc8..e8cf1192 100644
--- a/cmd/ghalistener/config/config.go
+++ b/cmd/ghalistener/config/config.go
@@ -80,7 +80,7 @@ func Read(ctx context.Context, configPath string) (*Config, error) {
 		return nil, fmt.Errorf("failed to get app config from vault: %w", err)
 	}
 
-	appConfig, err := appconfig.FromString(appConfigRaw)
+	appConfig, err := appconfig.FromJSONString(appConfigRaw)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read app config from string: %v", err)
 	}
diff --git a/controllers/actions.github.com/secret_resolver.go b/controllers/actions.github.com/secret_resolver.go
index 6a6dc62b..d5a4af08 100644
--- a/controllers/actions.github.com/secret_resolver.go
+++ b/controllers/actions.github.com/secret_resolver.go
@@ -257,7 +257,7 @@ func (r *vaultResolver) appConfig(ctx context.Context, key string) (*appconfig.A
 		return nil, fmt.Errorf("failed to resolve secret: %v", err)
 	}
 
-	return appconfig.FromString(val)
+	return appconfig.FromJSONString(val)
 }
 
 func (r *vaultResolver) proxyCredentials(ctx context.Context, key string) (*url.Userinfo, error) {