diff --git a/apps/crowdsec/manifests/netbird-router.yaml b/apps/crowdsec/manifests/netbird-router.yaml
new file mode 100644
index 0000000..ff813bd
--- /dev/null
+++ b/apps/crowdsec/manifests/netbird-router.yaml
@@ -0,0 +1,24 @@
+# Dedicated Netbird mesh router for the crowdsec namespace.
+#
+# Found missing 2026-08-17 while debugging why CrowdSec LAPI couldn't reach
+# api.crowdsec.net through the VPS proxy workaround (home's public IP is
+# WAF-blocked by CrowdSec's own API - see values.yaml HTTPS_PROXY comment).
+# Every other major namespace (gitlab, vault, argocd, nextcloud, etc.) has
+# its own 3-replica netbird-router deployment, auto-provisioned by the
+# netbird-operator from an NBRoutingPeer CR - crowdsec never got one because
+# it never previously needed mesh connectivity. Without it, crowdsec pods'
+# mesh-bound traffic had no reliable dedicated path, causing intermittent
+# connection resets/hangs to the VPS.
+#
+# None of the other 10 NBRoutingPeer CRs are tracked in git either (all
+# created out-of-band) - this is the first one committed, to avoid it being
+# similarly undiscoverable next time.
+apiVersion: netbird.io/v1
+kind: NBRoutingPeer
+metadata:
+  name: router
+  namespace: crowdsec
+  labels:
+    app.kubernetes.io/name: netbird-router
+spec:
+  resources: {}