diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml
index 37a68d0..1bedc2e 100644
--- a/k8s/argocd/apps/00-substrate.yaml
+++ b/k8s/argocd/apps/00-substrate.yaml
@@ -61,6 +61,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: ingress-nginx
   syncPolicy:
+    managedNamespaceMetadata:
+      # hostPort 80/443 requires the privileged PodSecurity level; the default
+      # baseline/restricted enforce blocks the controller DaemonSet.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true