diff --git a/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml b/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml
index 413333e..291bfa2 100644
--- a/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml
+++ b/servers/legion/k8s/neuron-technologies/dharma/ingressroute.yaml
@@ -14,5 +14,6 @@ spec:
       services:
         - name: dharma
           port: 8765
-  tls:
-    certResolver: letsencrypt
+  # TLS terminates at Cloudflare; tunnel reaches Traefik with noTLSVerify.
+  # Traefik websecure entrypoint has its own default cert (no resolver
+  # configured in this cluster), matching every other neuron-prod IngressRoute.