diff --git a/kubernetes/apps/audiobookshelf/ingress.yaml b/kubernetes/apps/audiobookshelf/ingress.yaml
index 25b5c589..d87d0458 100644
--- a/kubernetes/apps/audiobookshelf/ingress.yaml
+++ b/kubernetes/apps/audiobookshelf/ingress.yaml
@@ -3,20 +3,6 @@ kind: Ingress
 metadata:
   name: audiobookshelf
   namespace: audiobookshelf
-  labels:
-    # Publish through Cloudflare via the cluster's cargo tunnel. The
-    # cloudflare-scoped external-dns instance filters on this label
-    # and creates CNAMEs to the tunnel; cloudflared then needs a matching
-    # host entry in its configmap (see kubernetes/infrastructure/
-    # cloudflared/configmap.yaml). Both hostnames share the label,
-    # but only audiobooks.renner.uno is mapped in cloudflared — the
-    # .k.renner.uno LAN alias stays tunnel-404 (mirrors the immich /
-    # paperless approach).
-    # NOTE: Cloudflare's default body cap on free/pro plans is 100 MiB,
-    # so external uploads of single audio files above that size will
-    # fail at the edge even though ingress-nginx allows up to 500m.
-    # LAN clients bypass this entirely via audiobooks.k.renner.uno.
-    external-dns/cloudflare: "true"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-cluster
 spec: