diff --git a/docs/ops-sso-access.md b/docs/ops-sso-access.md
index 7ced997..459ad59 100644
--- a/docs/ops-sso-access.md
+++ b/docs/ops-sso-access.md
@@ -62,12 +62,17 @@ Priority for ops mutations (`POST /ops/...`):
 Create A records (or CNAME to the forgejo host pattern):
 
 ```text
-activity.coulomb.social           A  92.205.62.239
+activity.coulomb.social  A  92.205.62.239
 temporal.coulomb.social  A  92.205.62.239
 ```
 
-Until DNS exists, cert-manager Certificate will stay Pending and HTTPS will not
-serve. Manifests can still be applied.
+**Important:** do **not** leave a stale **AAAA** (IPv6) record for
+`activity.coulomb.social` pointing at parking (e.g. IONOS
+`2001:8d8:100f:f000::200` / `217.160.0.253`). Cluster resolvers prefer AAAA;
+cert-manager HTTP-01 self-check then hits the wrong host and returns 204.
+Either remove AAAA or set it to the railiance01 public IPv6.
+
+Until DNS is correct, cert-manager Certificate may stay Pending.
 
 ## Break-glass
 
diff --git a/k8s/railiance/31-ingress-ops-sso.yaml b/k8s/railiance/31-ingress-ops-sso.yaml
index 4d4c717..5b8e2c3 100644
--- a/k8s/railiance/31-ingress-ops-sso.yaml
+++ b/k8s/railiance/31-ingress-ops-sso.yaml
@@ -1,5 +1,7 @@
 # HTTPS SSO front door for activity-core ops console + API.
-# Requires DNS: activity.coulomb.social A → 92.205.62.239
+# Requires DNS:
+#   activity.coulomb.social  A    → 92.205.62.239
+#   (no stale AAAA / parking records — IPv6 must not point at IONOS parking)
 # ACTIVITY-WP-0025
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -12,9 +14,12 @@ metadata:
     app.kubernetes.io/component: sso-ingress
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    # HTTP-01 ACME needs web (80); browsers use websecure (443)
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
+    # Prefer ACME solver path over this catch-all when both match
+    traefik.ingress.kubernetes.io/router.priority: "1"
 spec:
   ingressClassName: traefik
   tls:
diff --git a/k8s/railiance/32-ingress-temporal-sso.yaml b/k8s/railiance/32-ingress-temporal-sso.yaml
index 9cb2c1b..a7c08a5 100644
--- a/k8s/railiance/32-ingress-temporal-sso.yaml
+++ b/k8s/railiance/32-ingress-temporal-sso.yaml
@@ -12,9 +12,10 @@ metadata:
     app.kubernetes.io/component: sso-ingress
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "1"
 spec:
   ingressClassName: traefik
   tls: