diff --git a/k8s/argocd/apps/04-management-service.yaml b/k8s/argocd/apps/04-management-service.yaml
index 3ffac2c..459c8ee 100644
--- a/k8s/argocd/apps/04-management-service.yaml
+++ b/k8s/argocd/apps/04-management-service.yaml
@@ -26,7 +26,7 @@ spec:
           authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
         ingress:
           enabled: true
-          host: kmsvc.homelab.internal
+          host: kmsvc.riotpiao.homelab.com
           clusterIssuer: homelab-ca
   destination:
     server: https://kubernetes.default.svc
diff --git a/k8s/charts/management-service/values.yaml b/k8s/charts/management-service/values.yaml
index 33844a7..e9937eb 100644
--- a/k8s/charts/management-service/values.yaml
+++ b/k8s/charts/management-service/values.yaml
@@ -40,10 +40,10 @@ ingress:
   enabled: true
   className: nginx
   clusterIssuer: homelab-ca
-  host: kmsvc.homelab.internal
+  host: kmsvc.riotpiao.homelab.com
   tlsSecretName: kmsvc-tls
   # kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default
-  # kmsvc.homelab.internal:443, see kmsvc-cli's README), so raw gRPC needs an
+  # kmsvc.riotpiao.homelab.com:443, see kmsvc-cli's README), so raw gRPC needs an
   # external path too — scoped to the gRPC service's own path prefix on the
   # same host/port, rather than opening the whole host to gRPC passthrough.
   grpcEnabled: true
diff --git a/k8s/environments/homelab.yaml b/k8s/environments/homelab.yaml
index 5ac66a3..9b13ca0 100644
--- a/k8s/environments/homelab.yaml
+++ b/k8s/environments/homelab.yaml
@@ -26,7 +26,7 @@ redis:
 
 managementService:
   ingress:
-    host: kmsvc.homelab.internal
+    host: kmsvc.riotpiao.homelab.com
     clusterIssuer: homelab-ca
   authentikIssuerURL: "https://authentik.riotpiao.homelab.com/application/o/kafaka/"
   authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"