diff --git a/kubernetes/apps/coder/helmrelease.yaml b/kubernetes/apps/coder/helmrelease.yaml
index 2d428816..b1a01a13 100644
--- a/kubernetes/apps/coder/helmrelease.yaml
+++ b/kubernetes/apps/coder/helmrelease.yaml
@@ -39,7 +39,9 @@ spec:
         host: coder.renner.uno
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-staging
-          external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+          # Coder is intentionally LAN-only — opt the Ingress out of
+          # external-dns so no public Cloudflare record is created.
+          external-dns.alpha.kubernetes.io/exclude: "true"
         tls:
           enable: true
           secretName: coder-tls