diff --git a/apps/base/authentik/gateway.yaml b/apps/base/authentik/gateway.yaml
index ef05aac..0662cee 100644
--- a/apps/base/authentik/gateway.yaml
+++ b/apps/base/authentik/gateway.yaml
@@ -1,23 +1,22 @@
 ---
-# Public identity.unkin.net listener. external-dns publishes the A record at the
-# internal LB VIP (198.18.200.4). Public TLS is terminated with the real Let's
-# Encrypt *.unkin.net wildcard, centrally minted once in the cert-manager
-# namespace (Certificate wildcard-unkin-net) and reflected into this namespace
-# by the emberstack reflector as the secret wildcard-unkin-net-tls. No
-# cert-manager annotations here so the gateway-shim does not mint a competing
-# Vault-PKI Certificate for the reflected secret.
+# External (DMZ) front for public identity.unkin.net, served via the external
+# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
+# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   labels:
-    traefik.io/instance: internal
+    traefik.io/instance: external
   annotations:
-    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+    argocd.argoproj.io/sync-wave: "2"
   name: authentik
   namespace: authentik
 spec:
-  gatewayClassName: traefik-internal
+  gatewayClassName: traefik-external
   listeners:
     - allowedRoutes:
         namespaces: