diff --git a/cluster/platform/cilium-config/values.yaml b/cluster/platform/cilium-config/values.yaml
index 302a338..bb9f2cb 100644
--- a/cluster/platform/cilium-config/values.yaml
+++ b/cluster/platform/cilium-config/values.yaml
@@ -3,38 +3,37 @@
 # Chart: https://helm.cilium.io
 # Version: 1.17.4
 #
-# These values are applied as a Helm upgrade over the bootstrap install.
-# --reuse-values is implicit via ArgoCD's Helm source — existing values
-# from the Talos bootstrap are preserved; we only override what's listed here.
-#
-# Talos bootstrap values (already set, do not need repeating):
-#   kubeProxyReplacement: true
-#   k8sServiceHost: 10.1.71.65
-#   k8sServicePort: 6443
-#   ipam.mode: kubernetes
-#   tunnel: vxlan
+# Full values required — ArgoCD does not reuse previous Helm release values.
 # ------------------------------------------------------------------------------
 
-# Enable Gateway API support — this is the key addition
-# Cilium operator will register as a GatewayClass controller automatically
+# Bootstrap values — must be repeated here
+kubeProxyReplacement: true
+k8sServiceHost: 10.1.71.65
+k8sServicePort: 6443
+ipam:
+  mode: kubernetes
+tunnel: vxlan
+
+# Gateway API support
 gatewayAPI:
   enabled: true
 
-# L2 announcements — ARP-based LB IP advertisement on the server VLAN
+# L2 announcements — ARP-based LB IP advertisement
 l2announcements:
   enabled: true
 
-# Rate limiting for L2 announcements — important with many services
-# Tune up if you see "rate limit exceeded" in cilium-operator logs
 k8sClientRateLimit:
   qps: 20
   burst: 40
 
-# ExternalIPs advertisement
 externalIPs:
   enabled: true
 
-# Hubble observability — worth enabling for visibility into cluster traffic
+# Talos compatibility — /etc/sysctl.d/ does not exist on Talos
+sysctlfix:
+  enabled: false
+
+# Hubble observability
 hubble:
   enabled: true
   relay:
@@ -54,30 +53,4 @@ hubble:
 prometheus:
   enabled: true
   serviceMonitor:
-    enabled: false  # enable once Prometheus operator is in-cluster
-
-# Talos compatibility — /etc/sysctl.d/ does not exist on Talos nodes
-# Without this the apply-sysctl-overwrites init container fails on Talos
-sysctlfix:
-  enabled: false
-
-# Talos security compatibility
-# Talos restricts Linux capabilities — these settings align Cilium with Talos constraints
-securityContext:
-  capabilities:
-    ciliumAgent:
-      - CHOWN
-      - KILL
-      - NET_ADMIN
-      - NET_RAW
-      - IPC_LOCK
-      - SYS_ADMIN
-      - SYS_RESOURCE
-      - DAC_OVERRIDE
-      - FOWNER
-      - SETGID
-      - SETUID
-    cleanCiliumState:
-      - NET_ADMIN
-      - SYS_ADMIN
-      - SYS_RESOURCE
+    enabled: false