diff --git a/k8s/bootstrap-local/06-ingress-nginx.yaml b/k8s/bootstrap-local/06-ingress-nginx.yaml
new file mode 100644
index 0000000..670d68c
--- /dev/null
+++ b/k8s/bootstrap-local/06-ingress-nginx.yaml
@@ -0,0 +1,56 @@
+# ingress-nginx - required for Forgejo domain access before ArgoCD can sync
+# This breaks the circular dependency: ArgoCD needs https://forgejo.riotpiao.com
+# but that domain requires ingress-nginx to route traffic.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx-bootstrap
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+    description: "Bootstrap ingress-nginx to enable Forgejo domain access"
+spec:
+  project: homelab
+  source:
+    repoURL: https://kubernetes.github.io/ingress-nginx
+    chart: ingress-nginx
+    targetRevision: "4.15.1"
+    helm:
+      values: |
+        controller:
+          kind: DaemonSet
+          service:
+            type: LoadBalancer
+            annotations:
+              io.cilium/lb-ipam-ips: "192.168.1.160"
+          hostPort:
+            enabled: false
+          tolerations:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+              effect: NoSchedule
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/k8s/bootstrap-local/kustomization.yaml b/k8s/bootstrap-local/kustomization.yaml
index 64950e5..6b7e78f 100644
--- a/k8s/bootstrap-local/kustomization.yaml
+++ b/k8s/bootstrap-local/kustomization.yaml
@@ -16,6 +16,7 @@ resources:
   - 03-ddb-bootstrap.yaml        # PostgreSQL cluster + Forgejo DB + Redis
   - 05-wait-for-databases.yaml   # Wait for CNPG to create databases
   - 04-forgejo.yaml              # Forgejo Helm chart (inline values)
+  - 06-ingress-nginx.yaml        # Ingress for Forgejo domain access
 
 # Notes:
 # - SOPS age secret created via bootstrap.sh (not in git)
diff --git a/k8s/bootstrap/ingress/ingress.yaml b/k8s/bootstrap/ingress/ingress.yaml
index a47e8b8..e59bd9b 100644
--- a/k8s/bootstrap/ingress/ingress.yaml
+++ b/k8s/bootstrap/ingress/ingress.yaml
@@ -219,7 +219,7 @@ spec:
               service:
                 name: forgejo-gitea-http
                 port:
-                  number: 7575
+                  number: 3000
 
 ---
 # ── Argo CD (cicd namespace) ──────────────────────────────────────────────────