diff --git a/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml b/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml
new file mode 100644
index 0000000..47661d0
--- /dev/null
+++ b/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml
@@ -0,0 +1,22 @@
+# Service alias for CoreDNS compatibility
+# CoreDNS rewrites *.riotpiao.com → ingress-nginx-controller.ingress-nginx.svc
+# But bootstrap deployed as ingress-nginx-bootstrap-controller
+# This alias makes both names work
+apiVersion: v1
+kind: Service
+metadata:
+  name: ingress-nginx-controller
+  namespace: ingress-nginx
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/instance: ingress-nginx-bootstrap
+    app.kubernetes.io/component: controller
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
+  - name: https
+    port: 443
+    targetPort: https
diff --git a/k8s/bootstrap/ingress/kustomization.yaml b/k8s/bootstrap/ingress/kustomization.yaml
index 10db163..c875a71 100644
--- a/k8s/bootstrap/ingress/kustomization.yaml
+++ b/k8s/bootstrap/ingress/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # No top-level namespace - resources declare their own namespaces
 resources:
-  - riotpiao-com-cert.yaml  # Certificate for *.riotpiao.com (ingress-nginx namespace)
-  - ingress.yaml             # Ingress rules for all services (multiple namespaces)
+  - ingress-nginx-controller-alias.yaml  # Service alias for CoreDNS compatibility
+  - riotpiao-com-cert.yaml                # Certificate for *.riotpiao.com (ingress-nginx namespace)
+  - ingress.yaml                           # Ingress rules for all services (multiple namespaces)