diff --git a/kubernetes/apps/coder/helmrelease.yaml b/kubernetes/apps/coder/helmrelease.yaml
index b1a01a13..3e169e19 100644
--- a/kubernetes/apps/coder/helmrelease.yaml
+++ b/kubernetes/apps/coder/helmrelease.yaml
@@ -39,9 +39,12 @@ spec:
         host: coder.renner.uno
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-staging
-          # Coder is intentionally LAN-only — opt the Ingress out of
-          # external-dns so no public Cloudflare record is created.
-          external-dns.alpha.kubernetes.io/exclude: "true"
+          # Intentionally no external-dns annotation: the Cloudflare
+          # external-dns filters on `cloudflare-proxied`, so absence =
+          # no public record. k8s-gateway still publishes the hostname
+          # to cluster-internal DNS because it watches Ingresses
+          # unconditionally (the `exclude` annotation would disable
+          # that too).
         tls:
           enable: true
           secretName: coder-tls