diff --git a/apps/guacamole/manifests/envoy-gateway.yaml b/apps/guacamole/manifests/envoy-gateway.yaml
index ad686a7..a382bdf 100644
--- a/apps/guacamole/manifests/envoy-gateway.yaml
+++ b/apps/guacamole/manifests/envoy-gateway.yaml
@@ -74,25 +74,3 @@ spec:
           name: guacamole
           port: 8080
           weight: 1
-
----
-# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
-# Without this, the OIDC callback can hit a different pod than the one that generated
-# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: BackendTrafficPolicy
-metadata:
-  name: guacamole-session-persistence
-  namespace: guacamole
-spec:
-  targetRefs:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      name: guacamole
-  loadBalancer:
-    type: ConsistentHash
-    consistentHash:
-      type: Cookie
-      cookie:
-        name: GUAC_ROUTE
-        ttl: 3600s
diff --git a/apps/guacamole/manifests/istio-virtualservice.yaml b/apps/guacamole/manifests/istio-virtualservice.yaml
index 972c6d6..8bfe90e 100644
--- a/apps/guacamole/manifests/istio-virtualservice.yaml
+++ b/apps/guacamole/manifests/istio-virtualservice.yaml
@@ -14,3 +14,21 @@ spec:
             host: guacamole.guacamole.svc.cluster.local
             port:
               number: 8080
+
+---
+# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
+# Without this, the OIDC callback can hit a different pod than the one that generated
+# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: guacamole
+  namespace: guacamole
+spec:
+  host: guacamole.guacamole.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        httpCookie:
+          name: GUAC_ROUTE
+          ttl: 3600s