diff --git a/k8s/bootstrap/phase4-argocd/argocd-values.yaml b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
index da7cf00..13dec33 100644
--- a/k8s/bootstrap/phase4-argocd/argocd-values.yaml
+++ b/k8s/bootstrap/phase4-argocd/argocd-values.yaml
@@ -6,23 +6,11 @@ global:
 
 # Server configuration
 server:
+  # Ingress is managed declaratively in k8s/bootstrap/ingress/ingress.yaml
+  # (ssl-passthrough) instead of here — two Ingress objects for the same
+  # host caused undefined nginx routing behavior (502s). Do not re-enable.
   ingress:
-    enabled: true
-    ingressClassName: nginx
-    annotations:
-      cert-manager.io/cluster-issuer: letsencrypt-prod
-      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    hosts:
-      - argocd.riotpiao.com
-    tls:
-      - secretName: argocd-server-tls
-        hosts:
-          - argocd.riotpiao.com
-
-  # Allow insecure mode (terminate TLS at ingress)
-  extraArgs:
-    - --insecure
+    enabled: false
 
   resources:
     requests:
@@ -152,7 +140,7 @@ configs:
     application.instanceLabelKey: argocd.argoproj.io/instance
     
   params:
-    server.insecure: true
+    server.insecure: false
 
   # RBAC (allow admin full access)
   rbac: