diff --git a/kotsadm/api/src/troubleshoot/troubleshoot_store.ts b/kotsadm/api/src/troubleshoot/troubleshoot_store.ts
index 1cb71890c6..2217657394 100644
--- a/kotsadm/api/src/troubleshoot/troubleshoot_store.ts
+++ b/kotsadm/api/src/troubleshoot/troubleshoot_store.ts
@@ -144,6 +144,7 @@ export class TroubleshootStore {
   }
 
   public async listSupportBundles(appOrWatchId: string): Promise<SupportBundle[]> {
+    // DANGER ZONE: changing sort order here afftects what support bundle is shown in the analysis view.
     const q = `select id from supportbundle where watch_id = $1 order by created_at desc`;
     const v = [appOrWatchId];
     const result = await this.pool.query(q, v);
diff --git a/kotsadm/web/src/components/troubleshoot/GenerateSupportBundle.jsx b/kotsadm/web/src/components/troubleshoot/GenerateSupportBundle.jsx
index 85e3062f2f..33f9dfbc54 100644
--- a/kotsadm/web/src/components/troubleshoot/GenerateSupportBundle.jsx
+++ b/kotsadm/web/src/components/troubleshoot/GenerateSupportBundle.jsx
@@ -63,7 +63,7 @@ class GenerateSupportBundle extends React.Component {
 
       if (listSupportBundles?.listSupportBundles.length > totalBundles) {
         listSupportBundles.stopPolling();
-        const bundle = listSupportBundles.listSupportBundles[listSupportBundles.listSupportBundles.length - 1];
+        const bundle = listSupportBundles.listSupportBundles[0]; // safe. there's at least 1 element in this array.
         history.push(`/app/${watch.slug}/troubleshoot/analyze/${bundle.id}`);
       }
     }
diff --git a/pkg/docker/registry/registry.go b/pkg/docker/registry/registry.go
index c0ab7d1d36..09245f4750 100644
--- a/pkg/docker/registry/registry.go
+++ b/pkg/docker/registry/registry.go
@@ -9,7 +9,6 @@ import (
 
 	"github.com/pkg/errors"
 	kotsv1beta1 "github.com/replicatedhq/kots/kotskinds/apis/kots/v1beta1"
-	"github.com/replicatedhq/kots/pkg/kotsadm/types"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -91,7 +90,6 @@ func PullSecretForRegistries(registries []string, username, password string, nam
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "kotsadm-replicated-registry",
 			Namespace: namespace,
-			Labels:    types.GetKotsadmLabels(),
 		},
 		Type: corev1.SecretTypeDockerConfigJson,
 		Data: map[string][]byte{
diff --git a/pkg/kotsadm/kotsadm_version.go b/pkg/kotsadm/kotsadm_version.go
index 27717c5a44..f8732a333c 100644
--- a/pkg/kotsadm/kotsadm_version.go
+++ b/pkg/kotsadm/kotsadm_version.go
@@ -76,6 +76,7 @@ func kotsadmPullSecret(namespace string, options types.KotsadmOptions) *corev1.S
 	}
 
 	secret.ObjectMeta.Name = types.PrivateKotsadmRegistrySecret
+	secret.ObjectMeta.Labels = types.GetKotsadmLabels()
 
 	return secret
 }