diff --git a/k8s/argocd/apps/60-applications.yaml b/k8s/argocd/apps/60-applications.yaml
index 95f526e..fa80286 100644
--- a/k8s/argocd/apps/60-applications.yaml
+++ b/k8s/argocd/apps/60-applications.yaml
@@ -236,6 +236,32 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
+# Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
+# which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: portfolio
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/riotpiao.com.git
+    targetRevision: main
+    path: infra/portfolio/base
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: portfolio
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
 # Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
 # every target namespace above already exists. Inert until kube-apiserver
 # gets --oidc-groups-claim=groups wired up (separate, not-yet-applied
diff --git a/k8s/argocd/projects/homelab-project.yaml b/k8s/argocd/projects/homelab-project.yaml
index 9417ace..2154ccf 100644
--- a/k8s/argocd/projects/homelab-project.yaml
+++ b/k8s/argocd/projects/homelab-project.yaml
@@ -16,9 +16,12 @@ spec:
     - https://github.com/Riotpiaole/Poimen-memory.git
     - https://github.com/Riotpiaole/Poimen-workflows.git
     - https://github.com/Riotpiaole/poimen*.git
-    # In-cluster Forgejo wildcard — all rock/* repos can be onboarded without
-    # touching this AppProject. Enabled by Stage 1 (A1). Includes poimen-* repos.
-    - https://forgejo.riotpiao.com/rock/*
+    # In-cluster Forgejo repos — explicit allowlist (no wildcard)
+    - https://forgejo.riotpiao.com/rock/homelab.git
+    - https://forgejo.riotpiao.com/rock/homelab-frontend.git
+    - https://forgejo.riotpiao.com/rock/kmsvc-manage.git
+    - https://forgejo.riotpiao.com/rock/poimen.git
+    - https://forgejo.riotpiao.com/rock/riotpiao.com.git
     # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
     - https://cloudnative-pg.github.io/charts
     - https://dl.gitea.com/charts/
diff --git a/terraform/files/coredns/Corefile b/terraform/files/coredns/Corefile
index ccab77d..6df1c75 100644
--- a/terraform/files/coredns/Corefile
+++ b/terraform/files/coredns/Corefile
@@ -35,6 +35,7 @@
     rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {
         pods insecure