diff --git a/servers/legion/dns-neuralplatform.tf b/servers/legion/dns-neuralplatform.tf
index 56e2745..1fb5f63 100644
--- a/servers/legion/dns-neuralplatform.tf
+++ b/servers/legion/dns-neuralplatform.tf
@@ -23,3 +23,16 @@ resource "cloudflare_record" "np_web_stage" {
   proxied = true
   ttl     = 1
 }
+
+# vault.neuralplatform.ai — GCE Raft HA Vault cluster via GCP Global HTTPS LB.
+# DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
+# Vault nodes listen on plain HTTP 8200 internally; LB does TLS.
+# IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
+resource "cloudflare_record" "np_vault" {
+  zone_id = local.zone_neuralplatform_ai
+  name    = "vault"
+  type    = "A"
+  content = "34.54.164.21"
+  proxied = false
+  ttl     = 60
+}
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 7ded466..8e54ff4 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -92,37 +92,11 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
-    ingress_rule {
-      hostname = "vault.neuralplatform.ai"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
-    }
+    # vault.neuralplatform.ai — moved to GCP Global HTTPS LB (34.54.164.21)
+    # DNS is now a direct A record (not proxied) in dns-neuralplatform.tf
 
-    ingress_rule {
-      hostname = "watch.nook.family"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
-    }
-
-    ingress_rule {
-      hostname = "jellyfin.nook.family"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
-    }
-
-    ingress_rule {
-      hostname = "bazarr.nook.family"
-      service  = "https://traefik.kube-system.svc:443"
-      origin_request {
-        no_tls_verify = true
-      }
-    }
+    # watch.nook.family, jellyfin.nook.family, bazarr.nook.family — removed
+    # This infrastructure is focused on Neuron; nook.family media stack retired
 
 
     # fornax.neuralplatform.ai — Fornax torrent coordinator (qBittorrent API proxy)