diff --git a/servers/legion/k8s/gitea-runner/gitea-proxy.yaml b/servers/legion/k8s/gitea-runner/gitea-proxy.yaml
index 00108b9..beb8e26 100644
--- a/servers/legion/k8s/gitea-runner/gitea-proxy.yaml
+++ b/servers/legion/k8s/gitea-runner/gitea-proxy.yaml
@@ -31,6 +31,9 @@ data:
         proxy_set_header CF-Access-Client-Id     "${CF_ACCESS_CLIENT_ID}";
         proxy_set_header CF-Access-Client-Secret "${CF_ACCESS_CLIENT_SECRET}";
 
+        # Send SNI so Cloudflare routes the TLS connection correctly.
+        proxy_ssl_server_name on;
+
         # Preserve Host so Gitea/CF edge routes correctly.
         proxy_set_header Host git.neuralplatform.ai;
 
@@ -58,7 +61,7 @@ metadata:
   name: gitea-proxy-secret
   namespace: ci
   annotations:
-    force-sync: "2026-05-05-initial"
+    force-sync: "2026-05-05-sni-fix"
 spec:
   refreshInterval: 1h
   secretStoreRef: