diff --git a/k8s/apps/cloudflared/configmap.yaml b/k8s/apps/cloudflared/configmap.yaml
index 563bac9..41804ba 100644
--- a/k8s/apps/cloudflared/configmap.yaml
+++ b/k8s/apps/cloudflared/configmap.yaml
@@ -51,25 +51,4 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
-      # KUBERNETES API, for kubectl from outside the LAN.
-      #
-      # Origin is the in-cluster Service, not the node IP: that survives a
-      # control-plane address change and lets the connectors reach whichever
-      # apiserver is local-healthy.
-      #
-      # noTLSVerify is required. The apiserver serves a certificate for the
-      # cluster CA plus its node/LB addresses, so its SANs cannot match this
-      # public hostname. Cloudflare terminates the public TLS with the
-      # *.riotpiao.com edge certificate, and the connector hop is already
-      # inside the cluster, so skipping verification on that short hop is the
-      # least-bad option. Do not widen this to other rules.
-      #
-      # SECURITY: this exposes the API to the internet. Authentication is still
-      # ZITADEL OIDC plus client certificates, but put a Cloudflare Access
-      # application in front of this hostname as well -- see the note in the
-      # PR. Without Access, every scanner on the internet reaches the apiserver.
-      - hostname: k8s.riotpiao.com
-        service: https://kubernetes.default.svc.cluster.local:443
-        originRequest:
-          noTLSVerify: true
       - service: http_status:404