diff --git a/servers/gcp/cloud-sql.tf b/servers/gcp/cloud-sql.tf
index 9947074..12cefec 100644
--- a/servers/gcp/cloud-sql.tf
+++ b/servers/gcp/cloud-sql.tf
@@ -174,7 +174,7 @@ resource "google_sql_user" "gitea" {
 # ── Gitea service account (for Workload Identity → Cloud SQL) ─────────────────
 
 resource "google_service_account" "gitea" {
-  account_id   = "gitea"
+  account_id   = "gitea-gke"
   display_name = "Gitea GKE SA"
   description  = "Service account for the Gitea pod on GKE. Used by the Cloud SQL Auth Proxy sidecar via Workload Identity."
   project      = var.project_id
diff --git a/servers/gcp/k8s/argocd-apps/gitea-gke.yaml b/servers/gcp/k8s/argocd-apps/gitea-gke.yaml
index 952e6b3..cb44b75 100644
--- a/servers/gcp/k8s/argocd-apps/gitea-gke.yaml
+++ b/servers/gcp/k8s/argocd-apps/gitea-gke.yaml
@@ -27,7 +27,7 @@ spec:
   destination:
     # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
     #   terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
-    server: https://GKE_CLUSTER_ENDPOINT
+    server: https://34.63.89.52
     namespace: gitea
   syncPolicy:
     automated:
diff --git a/servers/gcp/k8s/argocd-apps/vault-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-gke.yaml
index c4caec6..db8e7a9 100644
--- a/servers/gcp/k8s/argocd-apps/vault-gke.yaml
+++ b/servers/gcp/k8s/argocd-apps/vault-gke.yaml
@@ -22,7 +22,7 @@ spec:
   destination:
     # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
     #   terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
-    server: https://GKE_CLUSTER_ENDPOINT
+    server: https://34.63.89.52
     namespace: vault
   syncPolicy:
     automated:
diff --git a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
index 2a9fe69..46f4869 100644
--- a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
+++ b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
@@ -142,7 +142,7 @@ spec:
   destination:
     # Replace GKE_CLUSTER_ENDPOINT after `terraform apply`:
     #   terraform -chdir=servers/gcp output -raw gke_cluster_endpoint
-    server: https://GKE_CLUSTER_ENDPOINT
+    server: https://34.63.89.52
     namespace: vault
   syncPolicy:
     automated:
diff --git a/servers/gcp/k8s/gitea/serviceaccount.yaml b/servers/gcp/k8s/gitea/serviceaccount.yaml
index a0956f1..d45c293 100644
--- a/servers/gcp/k8s/gitea/serviceaccount.yaml
+++ b/servers/gcp/k8s/gitea/serviceaccount.yaml
@@ -7,4 +7,4 @@ metadata:
     # Workload Identity — allows the Cloud SQL Auth Proxy sidecar to authenticate
     # to Cloud SQL as the gitea GCP SA without a JSON key file.
     # The GCP SA binding is in servers/gcp/gke.tf (gitea_workload_identity).
-    iam.gke.io/gcp-service-account: gitea@neuron-785695.iam.gserviceaccount.com
+    iam.gke.io/gcp-service-account: gitea-gke@neuron-785695.iam.gserviceaccount.com