diff --git a/kube/deploy/apps/immich/app/lrp.yaml b/kube/deploy/apps/immich/app/lrp.yaml
deleted file mode 100644
index 995387f1..00000000
--- a/kube/deploy/apps/immich/app/lrp.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
----
-apiVersion: cilium.io/v2
-kind: CiliumLocalRedirectPolicy
-metadata:
-  name: &app immich-ml
-  namespace: &ns immich
-spec:
-  redirectFrontend:
-    serviceMatcher:
-      serviceName: *app
-      namespace: *ns
-  redirectBackend:
-    localEndpointSelector:
-      matchLabels:
-        app.kubernetes.io/name: immich
-        app.kubernetes.io/instance: immich
-        app.kubernetes.io/component: ml
-    toPorts:
-      - port: "3003"
-        protocol: TCP
-      - port: "3003"
-        protocol: UDP
-
diff --git a/kube/deploy/core/ingress/cloudflare/tunnel/hr.yaml b/kube/deploy/core/ingress/cloudflare/tunnel/hr.yaml
index 5a32746a..f7776fb2 100644
--- a/kube/deploy/core/ingress/cloudflare/tunnel/hr.yaml
+++ b/kube/deploy/core/ingress/cloudflare/tunnel/hr.yaml
@@ -54,7 +54,7 @@ spec:
             tunnel: "${SECRET_CLOUDFLARE_TUNNEL_ID}"
             credentials-file: /etc/cloudflared/credentials.json
             no-autoupdate: true
-            
+
             ingress:
               - hostname: "cftest.${DNS_SHORT}"
                 service: hello_world
@@ -62,40 +62,40 @@ spec:
               - hostname: "*"
                 path: "^/metrics"
                 service: http://default-backend.ingress.svc.cluster.local:80
-              
+
               - hostname: "${APP_DNS_FLUX_WEBHOOK}"
                 service: "http://webhook-receiver.flux-system.svc.cluster.local:80"
-              
+
               - hostname: "social.jjgadgets.tech"
                 service: https://gotosocial.gotosocial.svc.cluster.local.:8080
                 originRequest:
                   originServerName: "social.jjgadgets.tech"
-              
+
               - hostname: "${APP_DNS_HEADSCALE}"
                 service: https://headscale.headscale.svc.cluster.local.:8080
                 originRequest:
                   originServerName: "${APP_DNS_HEADSCALE}"
-              
+
               - hostname: "*.${DNS_SHORT}"
                 service: https://nginx-external-controller.ingress.svc.cluster.local:443
                 originRequest:
                   originServerName: "ingress.${DNS_SHORT}"
-              
+
               - hostname: "${DNS_SHORT}"
                 service: https://nginx-public-controller.ingress.svc.cluster.local:443
                 originRequest:
                   originServerName: "${DNS_SHORT}"
-              
+
               - hostname: "${APP_DNS_AUTHENTIK}"
-                service: https://nginx-public-controller.ingress.svc.cluster.local:443
+                service: https://nginx-external-controller.ingress.svc.cluster.local:443
                 originRequest:
                   originServerName: "${APP_DNS_AUTHENTIK}"
-              
+
               - hostname: "*.${DNS_MAIN}"
                 service: https://nginx-public-controller.ingress.svc.cluster.local:443
                 originRequest:
                   originServerName: "ingress.${DNS_MAIN}"
-              
+
               - service: http://default-backend.ingress.svc.cluster.local:80
 ---
 apiVersion: v1