diff --git a/kubernetes/apps/immich/ingress.yaml b/kubernetes/apps/immich/ingress.yaml
index 6208ac21..b9ba90e9 100644
--- a/kubernetes/apps/immich/ingress.yaml
+++ b/kubernetes/apps/immich/ingress.yaml
@@ -3,20 +3,6 @@ kind: Ingress
 metadata:
   name: immich
   namespace: immich
-  labels:
-    # Publish through Cloudflare via the cluster's cargo tunnel. The
-    # cloudflare-scoped external-dns instance filters on this label
-    # and creates CNAMEs to the tunnel; cloudflared then needs a matching
-    # host entry in its configmap (see kubernetes/infrastructure/
-    # cloudflared/configmap.yaml). All three hostnames share the label,
-    # but only immich.renner.uno is mapped in cloudflared —
-    # the .k.renner.uno LAN alias and the legacy photos.renner.uno stay
-    # tunnel-404 (mirrors the paperless approach for the .k aliases).
-    # NOTE: Cloudflare's default body cap on free/pro plans is 100 MiB,
-    # so external photo/video sync above that size will fail at the edge
-    # even though Traefik streams without a body cap. LAN clients
-    # bypass this entirely via immich.k.renner.uno.
-    external-dns/cloudflare: "true"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-cluster
 spec:
diff --git a/kubernetes/infrastructure/cloudflared/configmap.yaml b/kubernetes/infrastructure/cloudflared/configmap.yaml
index e615f736..9395538c 100644
--- a/kubernetes/infrastructure/cloudflared/configmap.yaml
+++ b/kubernetes/infrastructure/cloudflared/configmap.yaml
@@ -26,11 +26,6 @@ data:
         originRequest:
           noTLSVerify: true
 
-      - hostname: immich.renner.uno
-        service: https://traefik.ingress.svc.cluster.local:443
-        originRequest:
-          noTLSVerify: true
-
       - hostname: music.renner.uno
         service: https://traefik.ingress.svc.cluster.local:443
         originRequest: