diff --git a/client/builder.go b/client/builder.go
index 6d73f6eb..bbe81b6f 100644
--- a/client/builder.go
+++ b/client/builder.go
@@ -193,6 +193,9 @@ func (r *ClientBuilder) Setup() error {
 
 func (r *ClientBuilder) Build(kc client.Client, app *appcatalog.AppBinding) (*Config, map[string]atomic_writer.FileProjection, error) {
 	var cfg Config
+	if r.flags != nil {
+		cfg = *r.flags // initialize from the flags
+	}
 
 	addr, err := app.URL()
 	if err != nil {
@@ -209,14 +212,18 @@ func (r *ClientBuilder) Build(kc client.Client, app *appcatalog.AppBinding) (*Co
 		if err != nil {
 			return nil, nil, errors.Wrapf(err, "Secret %s not found", key)
 		}
+		// either basic auth or bearer token
 		if u, ok := authSecret.Data[core.BasicAuthUsernameKey]; ok {
 			cfg.BasicAuth.Username = string(u)
 			if p, ok := authSecret.Data[core.BasicAuthPasswordKey]; ok {
 				cfg.BasicAuth.Password = string(p)
 			}
+			cfg.BearerToken = ""
+			cfg.BearerTokenFile = ""
 		} else {
 			if p, ok := authSecret.Data["token"]; ok {
 				cfg.BearerToken = string(p)
+				cfg.BearerTokenFile = ""
 			}
 		}
 	}
diff --git a/go.mod b/go.mod
index d1948750..fe02a666 100644
--- a/go.mod
+++ b/go.mod
@@ -24,7 +24,7 @@ require (
 	k8s.io/klog/v2 v2.130.1
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
-	kmodules.xyz/client-go v0.34.4
+	kmodules.xyz/client-go v0.34.5
 	kmodules.xyz/custom-resources v0.34.0
 	sigs.k8s.io/controller-runtime v0.22.4
 )
diff --git a/go.sum b/go.sum
index 10a8d9c7..84438830 100644
--- a/go.sum
+++ b/go.sum
@@ -277,8 +277,8 @@ k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzk
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 kmodules.xyz/apiversion v0.2.0 h1:vAQYqZFm4xu4pbB1cAdHbFEPES6EQkcR4wc06xdTOWk=
 kmodules.xyz/apiversion v0.2.0/go.mod h1:oPX8g8LvlPdPX3Yc5YvCzJHQnw3YF/X4/jdW0b1am80=
-kmodules.xyz/client-go v0.34.4 h1:1WwI2iZYdGP8pD4j7dmNMDMsLha6JV4O08l/06LUtOU=
-kmodules.xyz/client-go v0.34.4/go.mod h1:myCt7AfRao4PBdUtKXu01xxbqqmLZ5U8fW0LQDaifhQ=
+kmodules.xyz/client-go v0.34.5 h1:mzhSQxKwGDXcEiUtABwqTNu5tVc3KsKc53foW5PHbT0=
+kmodules.xyz/client-go v0.34.5/go.mod h1:myCt7AfRao4PBdUtKXu01xxbqqmLZ5U8fW0LQDaifhQ=
 kmodules.xyz/custom-resources v0.34.0 h1:ljkIYzIq0A3Awj87kkpuYqS9aifuyR3Hr9q2OVKoojM=
 kmodules.xyz/custom-resources v0.34.0/go.mod h1:pcA/n/CnrycjKCRNtU9Z+l5svhzFncLY2Kn9pqeXDVs=
 sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
diff --git a/vendor/kmodules.xyz/client-go/meta/labels.go b/vendor/kmodules.xyz/client-go/meta/labels.go
index 41b1bc21..72c7208e 100644
--- a/vendor/kmodules.xyz/client-go/meta/labels.go
+++ b/vendor/kmodules.xyz/client-go/meta/labels.go
@@ -16,31 +16,42 @@ limitations under the License.
 
 package meta
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import (
+	"maps"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
 
 func LabelsForLabelSelector(sel *metav1.LabelSelector) (map[string]string, bool) {
-	if sel != nil {
-		if len(sel.MatchExpressions) > 0 {
-			expr := sel.MatchExpressions[0]
-			switch expr.Operator {
-			case metav1.LabelSelectorOpIn:
-				return map[string]string{
-					expr.Key: expr.Values[0],
-				}, false
-			case metav1.LabelSelectorOpNotIn:
-				return map[string]string{
-					expr.Key: "not-" + expr.Values[0],
-				}, false
-			case metav1.LabelSelectorOpExists:
-				return map[string]string{
-					expr.Key: "",
-				}, false
-			case metav1.LabelSelectorOpDoesNotExist:
-				return make(map[string]string), false
+	if sel == nil {
+		return make(map[string]string), true
+	}
+
+	labels := make(map[string]string, len(sel.MatchLabels)+len(sel.MatchExpressions))
+	maps.Copy(labels, sel.MatchLabels)
+
+	for _, expr := range sel.MatchExpressions {
+		switch expr.Operator {
+		case metav1.LabelSelectorOpIn:
+			if len(expr.Values) > 0 {
+				labels[expr.Key] = expr.Values[0]
+			}
+		case metav1.LabelSelectorOpNotIn:
+			if len(expr.Values) > 0 {
+				v := expr.Values[0]
+				if v == "true" && len(expr.Values) == 1 {
+					labels[expr.Key] = "false"
+				} else if v == "false" && len(expr.Values) == 1 {
+					labels[expr.Key] = "true"
+				} else {
+					labels[expr.Key] = "not-" + v
+				}
 			}
-		} else {
-			return sel.MatchLabels, true
+		case metav1.LabelSelectorOpExists:
+			labels[expr.Key] = ""
+		case metav1.LabelSelectorOpDoesNotExist:
+			delete(labels, expr.Key)
 		}
 	}
-	return make(map[string]string), true
+	return labels, len(sel.MatchExpressions) == 0
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 02f8e8e4..6e86c311 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -764,7 +764,7 @@ k8s.io/utils/trace
 # kmodules.xyz/apiversion v0.2.0
 ## explicit; go 1.14
 kmodules.xyz/apiversion
-# kmodules.xyz/client-go v0.34.4
+# kmodules.xyz/client-go v0.34.5
 ## explicit; go 1.24.0
 kmodules.xyz/client-go
 kmodules.xyz/client-go/api/v1