diff --git a/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml b/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
index b064f3a..7297553 100644
--- a/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
+++ b/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
@@ -39,17 +39,17 @@ spec:
                 kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
               done
 
-              # Annotate services for NetBird VPN resource auto-discovery
-              echo "Annotating services for NetBird VPN resource discovery..."
-              kubectl annotate svc -n gitlab gitlab-webservice-default netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n grafana grafana netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n home-assistant home-assistant netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n guacamole guacamole netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n nextcloud nextcloud netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n argocd argocd-server netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n frigate frigate netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n teslamate teslamate netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n home-assistant esphome netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n prometheus kube-prometheus-stack-prometheus netbird.io/resource="true" --overwrite 2>/dev/null || true
-              kubectl annotate svc -n vault vault netbird.io/resource="true" --overwrite 2>/dev/null || true
+              # Annotate services for NetBird operator auto-discovery (netbird.io/expose triggers the operator)
+              echo "Annotating services for NetBird operator exposure..."
+              kubectl annotate svc -n gitlab gitlab-webservice-default netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n grafana grafana netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n home-assistant home-assistant netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n guacamole guacamole netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n nextcloud nextcloud netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n argocd argocd-server netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n frigate frigate netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n teslamate teslamate netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n home-assistant esphome netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n prometheus kube-prometheus-stack-prometheus netbird.io/expose="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n vault vault netbird.io/expose="true" --overwrite 2>/dev/null || true
               echo "App namespace enrollment and NetBird annotations complete"