diff --git a/clusters/prod/kustomization.yaml b/clusters/prod/kustomization.yaml
index 9081d3f..1f22fbd 100644
--- a/clusters/prod/kustomization.yaml
+++ b/clusters/prod/kustomization.yaml
@@ -203,7 +203,21 @@ patches:
         # Verified before the switch: a throwaway pod INSIDE prod resolved this host through
         # in-cluster CoreDNS to the Gateway VIP and cloned over the public LE cert with no CA
         # supplied. The workstation being able to reach it proves nothing about pod egress.
-        url: https://gitea.prod.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git
+        # MOVED WITH THE APEX FLIP (2026-09-13) — and it had to move in the SAME fetch.
+        # This URL is a hardcoded literal, NOT templated on ${BASE_DOMAIN}, so the flip did not
+        # carry it. But the flip DOES rename prod's own HTTPRoute hostnames, so:
+        #   - external-dns (policy=sync) deletes gitea.prod.home.keithjackson.dev, and
+        #   - platform/coredns/coredns-custom.yaml answers the whole ${BASE_DOMAIN} zone with
+        #     ${GATEWAY_VIP}, so in-cluster resolution moves from prod.home. to home.
+        # Leaving this on the old name would therefore have severed prod from its OWN GitOps
+        # source moments after the flip reconciled — self-reference, the same class of trap as
+        # patching this url live and having the root Kustomization revert it. The fix has to land
+        # THROUGH THE OLD SOURCE, which is why it is in the same push as the flip rather than
+        # after it.
+        # FOLLOW-UP worth doing: point this at the in-cluster Service
+        # (gitea-http.gitea.svc.cluster.local) so prod's GitOps stops depending on public DNS and
+        # on its own Gateway at all. Deferred: it needs the TLS/credential path rethought.
+        url: https://gitea.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git
         ref:
           branch: main
   - target: