diff --git a/cluster/platform/cilium-config/application.yaml b/cluster/platform/cilium-config/application.yaml
index 26d2b1d..04345b6 100644
--- a/cluster/platform/cilium-config/application.yaml
+++ b/cluster/platform/cilium-config/application.yaml
@@ -4,17 +4,11 @@
 #
 # This Application does two things:
 #   1. Manages Cilium itself via Helm (enables Gateway API, keeps config in git)
-#   2. Applies LB pool and L2 announcement manifests
-#
-# On first sync, ArgoCD will upgrade Cilium in-place with --reuse-values
-# plus our additions (gatewayAPI.enabled, l2announcements, etc.).
-# Cilium operator and daemonset will rolling-restart automatically.
+#   2. Applies LB pool and L2 announcement manifests from repo
 #
 # IP Allocation:
-#   10.1.71.80       — ingress-nginx (reserved, not from pool)
-#   10.1.71.81       — Cilium Gateway (reserved, not from pool)
-#   10.1.71.82-.89   — ingress-nginx LB pool (future additional controllers)
-#   10.1.71.90-.99   — Cilium Gateway LB pool
+#   10.1.71.80-.89  — ingress-nginx LB pool
+#   10.1.71.90-.99  — Cilium Gateway LB pool
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -31,11 +25,12 @@ spec:
       chart: cilium
       targetRevision: 1.17.4
       helm:
-        valuesFiles:
+        valueFiles:
           - $values/cluster/platform/cilium-config/values.yaml
-    # Source 2: Our repo — provides the values file and manifests
+    # Source 2: Repo — values ref + lb-pool.yaml + GatewayClass manifests
     - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
       targetRevision: main
+      path: cluster/platform/cilium-config/manifests
       ref: values
   destination:
     server: https://kubernetes.default.svc
diff --git a/cluster/platform/external-dns/application.yaml b/cluster/platform/external-dns/application.yaml
index 979639c..8065eba 100644
--- a/cluster/platform/external-dns/application.yaml
+++ b/cluster/platform/external-dns/application.yaml
@@ -1,7 +1,7 @@
 # ------------------------------------------------------------------------------
 # Platform: external-dns
-# Wave 6 — depends on ingress-nginx (wave 5) to have an IP to register
-# Configured to sync with Technitium DNS on monorail (10.1.71.32)
+# Wave 6 — depends on ingress-nginx (wave 5)
+# Multi-source: Helm chart from upstream + ExternalSecret from repo
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -12,13 +12,19 @@ metadata:
     argocd.argoproj.io/sync-wave: "6"
 spec:
   project: default
-  source:
-    repoURL: https://kubernetes-sigs.github.io/external-dns
-    chart: external-dns
-    targetRevision: 1.15.1
-    helm:
-      valueFiles:
-          - values.yaml
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://kubernetes-sigs.github.io/external-dns
+      chart: external-dns
+      targetRevision: 1.15.1
+      helm:
+        valueFiles:
+          - $values/cluster/platform/external-dns/values.yaml
+    # Source 2: Repo — values ref + ExternalSecret manifest
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/external-dns
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: external-dns
diff --git a/cluster/platform/ingress-nginx/application.yaml b/cluster/platform/ingress-nginx/application.yaml
index 3eca311..1572dfe 100644
--- a/cluster/platform/ingress-nginx/application.yaml
+++ b/cluster/platform/ingress-nginx/application.yaml
@@ -1,6 +1,7 @@
 # ------------------------------------------------------------------------------
 # Platform: ingress-nginx
-# Wave 5 — depends on Cilium LB pool (wave 4) to get a LoadBalancer IP
+# Wave 5 — depends on Cilium LB pool (wave 4)
+# Multi-source: Helm chart from upstream + values from repo
 # ------------------------------------------------------------------------------
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -11,13 +12,18 @@ metadata:
     argocd.argoproj.io/sync-wave: "5"
 spec:
   project: default
-  source:
-    repoURL: https://kubernetes.github.io/ingress-nginx
-    chart: ingress-nginx
-    targetRevision: 4.12.1
-    helm:
-      valueFiles:
-          - values.yaml
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://kubernetes.github.io/ingress-nginx
+      chart: ingress-nginx
+      targetRevision: 4.12.1
+      helm:
+        valueFiles:
+          - $values/cluster/platform/ingress-nginx/values.yaml
+    # Source 2: Repo — values ref only, no extra manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: ingress-nginx