diff --git a/k8s/apps/cloudflared/configmap.yaml b/k8s/apps/cloudflared/configmap.yaml
index 656469c..138d416 100644
--- a/k8s/apps/cloudflared/configmap.yaml
+++ b/k8s/apps/cloudflared/configmap.yaml
@@ -53,4 +53,25 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
+      # KUBERNETES API, for kubectl from outside the LAN.
+      #
+      # Origin is the in-cluster Service, not the node IP: that survives a
+      # control-plane address change and lets the connectors reach whichever
+      # apiserver is local-healthy.
+      #
+      # noTLSVerify is required. The apiserver serves a certificate for the
+      # cluster CA plus its node/LB addresses, so its SANs cannot match this
+      # public hostname. Cloudflare terminates the public TLS with the
+      # *.riotpiao.com edge certificate, and the connector hop is already
+      # inside the cluster, so skipping verification on that short hop is the
+      # least-bad option. Do not widen this to other rules.
+      #
+      # SECURITY: this exposes the API to the internet. Authentication is still
+      # ZITADEL OIDC plus client certificates, but put a Cloudflare Access
+      # application in front of this hostname as well -- see the note in the
+      # PR. Without Access, every scanner on the internet reaches the apiserver.
+      - hostname: k8s.riotpiao.com
+        service: https://kubernetes.default.svc.cluster.local:443
+        originRequest:
+          noTLSVerify: true
       - service: http_status:404