diff --git a/kubernetes/infrastructure/traefik/helmrelease.yaml b/kubernetes/infrastructure/traefik/helmrelease.yaml
index bb9c70e2..11837336 100644
--- a/kubernetes/infrastructure/traefik/helmrelease.yaml
+++ b/kubernetes/infrastructure/traefik/helmrelease.yaml
@@ -53,6 +53,12 @@ spec:
         bouncer:
           moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
           version: v1.6.0
+    # Attach the CrowdSec bouncer to every router on the websecure
+    # entrypoint (global enforcement). The chart's values schema (40.x) has
+    # no `ports.<ep>.middlewares` key, so set the entrypoint default
+    # middleware via static config CLI flag instead.
+    additionalArguments:
+      - "--entryPoints.websecure.http.middlewares=ingress-crowdsec-bouncer@kubernetescrd"
     ingressClass:
       enabled: true
       isDefaultClass: false
@@ -83,12 +89,6 @@ spec:
               scheme: https
               permanent: true
       websecure:
-        # Apply the CrowdSec bouncer to every router on this entrypoint —
-        # global enforcement, like the old ingress-nginx Lua bouncer. The
-        # Middleware itself is fail-open (see crowdsec-middleware.yaml), so
-        # a CrowdSec/LAPI outage never black-holes ingress.
-        middlewares:
-          - ingress-crowdsec-bouncer@kubernetescrd
         # HTTP/3 is the headline reason for this migration — ingress-nginx
         # cannot serve QUIC on UDP/443, so LAN clients that learned the
         # `alpn=h3` hint (DNS HTTPS RR / Alt-Svc) over Cloudflare get