diff --git a/clusters/prod/kustomization.yaml b/clusters/prod/kustomization.yaml
index 1f22fbd..adced93 100644
--- a/clusters/prod/kustomization.yaml
+++ b/clusters/prod/kustomization.yaml
@@ -217,7 +217,24 @@ patches:
         # FOLLOW-UP worth doing: point this at the in-cluster Service
         # (gitea-http.gitea.svc.cluster.local) so prod's GitOps stops depending on public DNS and
         # on its own Gateway at all. Deferred: it needs the TLS/credential path rethought.
-        url: https://gitea.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git
+        # IN-CLUSTER SERVICE, NOT A PUBLIC HOSTNAME (2026-09-13). This is the durable fix for a
+        # deadlock the apex flip walked straight into, and it is worth stating precisely.
+        #
+        # The url used to be a public name. The flip renamed prod's HTTPRoute hostnames, so the
+        # name this GitRepository pointed at stopped serving — but the HTTPRoute that WOULD have
+        # served the new name lives in a DOWNSTREAM tier, which cannot reconcile while the source
+        # is broken. Source down -> routes never rename -> source stays down. Observed live:
+        # `srcReady=False`, "unable to list remote for https://gitea.home.keithjackson.dev".
+        #
+        # Pointing at the Service breaks the cycle permanently: prod's GitOps no longer depends on
+        # public DNS, on Cloudflare, on its own Gateway, or on ${BASE_DOMAIN} at all. A future
+        # domain change cannot sever prod from its own source again.
+        #
+        # Plain http is deliberate and safe here: it is cluster-internal traffic to a ClusterIP,
+        # TLS terminates at the Gateway for external clients only, the GitRepository has no
+        # secretRef (the repo is cloned anonymously), and every secret in the tree is SOPS-encrypted
+        # at rest regardless of transport.
+        url: http://gitea.gitea.svc.cluster.local:3000/Home-Network/home-network-k3s-impl.git
         ref:
           branch: main
   - target: