diff --git a/cluster/platform/argocd/application.yaml b/cluster/platform/argocd/application.yaml
index 33298d6..ffa4163 100644
--- a/cluster/platform/argocd/application.yaml
+++ b/cluster/platform/argocd/application.yaml
@@ -24,6 +24,8 @@ spec:
     repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
     targetRevision: main
     path: cluster/platform/argocd
+    directory:
+        exclude: "application.yaml"
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
diff --git a/cluster/platform/argocd/argocd-params.yaml b/cluster/platform/argocd/argocd-params.yaml
new file mode 100644
index 0000000..ede1927
--- /dev/null
+++ b/cluster/platform/argocd/argocd-params.yaml
@@ -0,0 +1,11 @@
+# ------------------------------------------------------------------------------
+# ArgoCD Server Parameters
+# Sets server.insecure=true so TLS is terminated at ingress, not argocd-server
+# ------------------------------------------------------------------------------
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+  namespace: argocd
+data:
+  server.insecure: "true"
\ No newline at end of file
diff --git a/cluster/platform/argocd/ingress.yaml b/cluster/platform/argocd/ingress.yaml
new file mode 100644
index 0000000..f517f67
--- /dev/null
+++ b/cluster/platform/argocd/ingress.yaml
@@ -0,0 +1,31 @@
+# ------------------------------------------------------------------------------
+# Ingress — ArgoCD via ingress-nginx
+# Temporary until Cilium Gateway API is stable
+# TLS terminated at ingress, argocd-server runs in insecure mode
+# ------------------------------------------------------------------------------
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - argocd.local.mk-labs.cloud
+      secretName: argocd-tls
+  rules:
+    - host: argocd.local.mk-labs.cloud
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80