diff --git a/components/ws-manager-api/go/crd/v1/workspace_types.go b/components/ws-manager-api/go/crd/v1/workspace_types.go
index 39ea44c4c61d5a..e507d72b5904fa 100644
--- a/components/ws-manager-api/go/crd/v1/workspace_types.go
+++ b/components/ws-manager-api/go/crd/v1/workspace_types.go
@@ -228,7 +228,7 @@ type WorkspaceRuntimeStatus struct {
 // Columns with priority > 0 will only show up with `-o wide`.
 //+kubebuilder:printcolumn:name="Workspace",type="string",JSONPath=".spec.ownership.workspaceID",priority=10
 //+kubebuilder:printcolumn:name="Class",type="string",JSONPath=".spec.class"
-//+kubebuilder:printcolumn:name="Type",type="string",JSONPath=".spec.type",priority=10
+//+kubebuilder:printcolumn:name="Type",type="string",JSONPath=".spec.type"
 //+kubebuilder:printcolumn:name="Node",type="string",JSONPath=".status.runtime.nodeName"
 //+kubebuilder:printcolumn:name="Owner",type="string",JSONPath=".spec.ownership.owner"
 //+kubebuilder:printcolumn:name="Team",type="string",JSONPath=".spec.ownership.team"
diff --git a/components/ws-manager-mk2/config/crd/bases/workspace.gitpod.io_workspaces.yaml b/components/ws-manager-mk2/config/crd/bases/workspace.gitpod.io_workspaces.yaml
index 89770a3eea9f73..c520316517f415 100644
--- a/components/ws-manager-mk2/config/crd/bases/workspace.gitpod.io_workspaces.yaml
+++ b/components/ws-manager-mk2/config/crd/bases/workspace.gitpod.io_workspaces.yaml
@@ -31,7 +31,6 @@ spec:
       type: string
     - jsonPath: .spec.type
       name: Type
-      priority: 10
       type: string
     - jsonPath: .status.runtime.nodeName
       name: Node
diff --git a/components/ws-manager-mk2/controllers/workspace_controller.go b/components/ws-manager-mk2/controllers/workspace_controller.go
index 9605149343bd1c..61def817bf77e0 100644
--- a/components/ws-manager-mk2/controllers/workspace_controller.go
+++ b/components/ws-manager-mk2/controllers/workspace_controller.go
@@ -121,7 +121,7 @@ func (r *WorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 
 	r.updateMetrics(ctx, &workspace)
 
-	log.V(1).Info("updated workspace status", "status", workspace.Status)
+	log.V(1).Info("updating workspace status", "status", workspace.Status)
 	err = r.Status().Update(ctx, &workspace)
 	if err != nil {
 		// log.WithValues("status", workspace).Error(err, "unable to update workspace status")
@@ -189,6 +189,10 @@ func (r *WorkspaceReconciler) actOnStatus(ctx context.Context, workspace *worksp
 			r.metrics.rememberWorkspace(workspace, nil)
 
 		case workspace.Status.Phase == workspacev1.WorkspacePhaseStopped:
+			if err := r.deleteWorkspaceSecrets(ctx, workspace); err != nil {
+				return ctrl.Result{}, err
+			}
+
 			// Done stopping workspace - remove finalizer.
 			if controllerutil.ContainsFinalizer(workspace, workspacev1.GitpodFinalizerName) {
 				controllerutil.RemoveFinalizer(workspace, workspacev1.GitpodFinalizerName)
@@ -197,10 +201,6 @@ func (r *WorkspaceReconciler) actOnStatus(ctx context.Context, workspace *worksp
 				}
 			}
 
-			if err := r.deleteWorkspaceSecrets(ctx, workspace); err != nil {
-				return ctrl.Result{RequeueAfter: 10 * time.Second}, err
-			}
-
 			// Workspace might have already been in a deleting state,
 			// but not guaranteed, so try deleting anyway.
 			err := r.Client.Delete(ctx, workspace)
diff --git a/components/ws-manager-mk2/main.go b/components/ws-manager-mk2/main.go
index f802614895fe52..23154c6b6feb85 100644
--- a/components/ws-manager-mk2/main.go
+++ b/components/ws-manager-mk2/main.go
@@ -99,6 +99,17 @@ func main() {
 		go pprof.Serve(cfg.PProf.Addr)
 	}
 
+	// Check that namespace config values are set. Empty namespaces default to a cluster-scoped cache,
+	// which the controller doesn't have the right RBAC for.
+	if cfg.Manager.Namespace == "" {
+		setupLog.Error(nil, "namespace cannot be empty")
+		os.Exit(1)
+	}
+	if cfg.Manager.SecretsNamespace == "" {
+		setupLog.Error(nil, "secretsNamespace cannot be empty")
+		os.Exit(1)
+	}
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:                 scheme,
 		MetricsBindAddress:     cfg.Prometheus.Addr,