diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index 4a8b872..425a15d 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -59,25 +59,12 @@ data:
         - verb: GET
           upstreamPath: /sqs/queues
 
-    - serviceName: workflow
-      upstream:
-        url: http://temporal-frontend.temporal.svc.cluster.local:7233
-        timeoutSeconds: 60
-      auth:
-        required: false
-      resources:
-      - name: execute
-        methods:
-        - verb: POST
-          upstreamPath: /workflow/execute
-      - name: describe
-        methods:
-        - verb: GET
-          upstreamPath: /workflow/describe
-      - name: list
-        methods:
-        - verb: GET
-          upstreamPath: /workflow/list
+    # NOTE: temporal-frontend (port 7233) is gRPC-only, not HTTP.
+    # External worker/SDK access is unresolved per homelab/project-usage/jwt-auth-rollout.md
+    # Disabled until a gRPC-capable ingress is added.
+    # - serviceName: workflow
+    #   upstream:
+    #     url: http://temporal-frontend.temporal.svc.cluster.local:7233
 
     - serviceName: memory
       upstream: