diff --git a/kube/3-deploy/2-apps/kanidm/app/hr.yaml b/kube/3-deploy/2-apps/kanidm/app/hr.yaml
index f1e74ba5..1872ac97 100644
--- a/kube/3-deploy/2-apps/kanidm/app/hr.yaml
+++ b/kube/3-deploy/2-apps/kanidm/app/hr.yaml
@@ -53,7 +53,8 @@ spec:
         primary: true
         ingressClassName: nginx
         annotations:
-          external-dns.alpha.kubernetes.io/target: "${IP_EC2_INGRESS}"
+          external-dns.alpha.kubernetes.io/target: "${DNS_SHORT_CF}"
+          external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
           nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
           # https://github.com/kubernetes/ingress-nginx/issues/6728
           nginx.ingress.kubernetes.io/server-snippet: |