diff --git a/kubernetes/talos-flux/apps/networking/cloudflared/app/config.yaml b/kubernetes/talos-flux/apps/networking/cloudflared/app/config.yaml
index c1904ea2c..853141b77 100644
--- a/kubernetes/talos-flux/apps/networking/cloudflared/app/config.yaml
+++ b/kubernetes/talos-flux/apps/networking/cloudflared/app/config.yaml
@@ -37,6 +37,10 @@ ingress:
     service: https://arc-webhook.${SECRET_DOMAIN}
     originRequest:
       httpHostHeader: arc-webhook.${SECRET_DOMAIN}
+  - hostname: kromgo.${SECRET_DOMAIN}
+    service: https://kromgo.${SECRET_DOMAIN}
+    originRequest:
+      httpHostHeader: kromgo.${SECRET_DOMAIN}
   # - hostname: example2.com
   #   service: localhost:8001
   # The localhost:8002 service overrides some root-level config.
diff --git a/kubernetes/talos-flux/apps/observability/kromgo/app/helm-release.yaml b/kubernetes/talos-flux/apps/observability/kromgo/app/helm-release.yaml
index 3d06a3cbe..3e60297bc 100644
--- a/kubernetes/talos-flux/apps/observability/kromgo/app/helm-release.yaml
+++ b/kubernetes/talos-flux/apps/observability/kromgo/app/helm-release.yaml
@@ -88,7 +88,7 @@ spec:
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
           traefik.ingress.kubernetes.io/affinity: "true"
           traefik.ingress.kubernetes.io/router.tls: "true"
-          # external-dns.alpha.kubernetes.io/target: "${SECRET_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"
+          external-dns.alpha.kubernetes.io/target: "${SECRET_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"
           # hajimari.io/icon: video-input-antenna
           # hajimari.io/enable: "true"
         hosts: