diff --git a/manifests/coulomb-social-ingress.yaml b/manifests/coulomb-social-ingress.yaml
index 9fe3d81..3b9cb46 100644
--- a/manifests/coulomb-social-ingress.yaml
+++ b/manifests/coulomb-social-ingress.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: coulomb-social
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    # websecure only (forgejo pattern): leave HTTP free for cert-manager HTTP-01
+    # solvers. TLS app traffic stays on 443; ACME challenge uses solver ingress on 80.
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik