diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7ecfb5d..82a7781 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Look for Cluster in organization namespace in vintage MCs
+
 ### Added
 
 - Add option to `setup` to use credentials as base64 encoded variables.
diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index 99ebbd4..c2420c1 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/giantswarm/dex-operator/pkg/key"
 
@@ -166,12 +167,24 @@ func (s *Service) ReconcileDelete(ctx context.Context) error {
 }
 
 func (s *Service) getAPIServerPort(clusterID string, ctx context.Context) (int, error) {
+	var namespace string
+	{
+		if isOrgNamespace(s.app.Namespace) {
+			namespace = s.app.Namespace
+		} else {
+			namespace = "org-" + s.app.GetLabels()[label.Organization]
+		}
+	}
 	cluster := &capi.Cluster{}
 	if err := s.Get(ctx, types.NamespacedName{
 		Name:      clusterID,
-		Namespace: s.app.Namespace},
+		Namespace: namespace},
 		cluster); err != nil {
 		return 0, err
 	}
 	return int(cluster.Spec.ControlPlaneEndpoint.Port), nil
 }
+
+func isOrgNamespace(namespace string) bool {
+	return strings.HasPrefix(namespace, "org-")
+}
diff --git a/pkg/auth/auth_test.go b/pkg/auth/auth_test.go
index 459e57f..e49e78f 100644
--- a/pkg/auth/auth_test.go
+++ b/pkg/auth/auth_test.go
@@ -88,8 +88,8 @@ func TestReconcile(t *testing.T) {
 				app: &v1alpha1.App{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      "test",
-						Namespace: "example",
-						Labels:    map[string]string{label.Cluster: tc.clusterName},
+						Namespace: "org-example",
+						Labels:    map[string]string{label.Cluster: tc.clusterName, label.Organization: "example"},
 					},
 				},
 				writeAllGroups:        tc.writeAllGroups,
@@ -103,7 +103,7 @@ func TestReconcile(t *testing.T) {
 			result := &corev1.ConfigMap{}
 			if err := service.Client.Get(ctx, types.NamespacedName{
 				Name:      key.GetAuthConfigName(tc.clusterName),
-				Namespace: "example"},
+				Namespace: "org-example"},
 				result); err != nil {
 				if !apierrors.IsNotFound(err) {
 					t.Fatal(err)
@@ -121,7 +121,7 @@ func getTestCluster() *capi.Cluster {
 	return &capi.Cluster{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "wc",
-			Namespace: "example",
+			Namespace: "org-example",
 		},
 		Spec: capi.ClusterSpec{
 			ControlPlaneEndpoint: capi.APIEndpoint{