diff --git a/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml b/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml
deleted file mode 100644
index 47661d0..0000000
--- a/k8s/bootstrap/ingress/ingress-nginx-controller-alias.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# Service alias for CoreDNS compatibility
-# CoreDNS rewrites *.riotpiao.com → ingress-nginx-controller.ingress-nginx.svc
-# But bootstrap deployed as ingress-nginx-bootstrap-controller
-# This alias makes both names work
-apiVersion: v1
-kind: Service
-metadata:
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx-bootstrap
-    app.kubernetes.io/component: controller
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
-  - name: https
-    port: 443
-    targetPort: https
diff --git a/k8s/bootstrap/ingress/kustomization.yaml b/k8s/bootstrap/ingress/kustomization.yaml
index c875a71..e499322 100644
--- a/k8s/bootstrap/ingress/kustomization.yaml
+++ b/k8s/bootstrap/ingress/kustomization.yaml
@@ -2,6 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # No top-level namespace - resources declare their own namespaces
 resources:
-  - ingress-nginx-controller-alias.yaml  # Service alias for CoreDNS compatibility
+  # ingress-nginx-controller-alias.yaml REMOVED — it was a ClusterIP Service named
+  # ingress-nginx-controller with a stale selector (instance: ingress-nginx-bootstrap,
+  # a release that no longer exists). ingress-config's selfHeal kept re-applying it
+  # over the helm release's real LoadBalancer Service of the same name, reverting it
+  # to a ClusterIP with zero endpoints -> LB IP .160 unannounced -> cluster-wide
+  # outage. CoreDNS rewrites *.riotpiao.com to ingress-nginx-controller.ingress-nginx
+  # .svc, which is the helm Service directly — no alias needed.
   - riotpiao-com-cert.yaml                # Certificate for *.riotpiao.com (ingress-nginx namespace)
   - ingress.yaml                           # Ingress rules for all services (multiple namespaces)