diff --git a/argocd-apps/infrastructure/coredns.yaml b/argocd-apps/infrastructure/coredns.yaml
new file mode 100644
index 0000000..560409f
--- /dev/null
+++ b/argocd-apps/infrastructure/coredns.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: coredns
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"  # cluster DNS - as early as anything can depend on it
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: infrastructure
+  source:
+    repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+    targetRevision: main
+    path: infrastructure/coredns/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/infrastructure/coredns/manifests/coredns-configmap.yaml b/infrastructure/coredns/manifests/coredns-configmap.yaml
new file mode 100644
index 0000000..a3dd028
--- /dev/null
+++ b/infrastructure/coredns/manifests/coredns-configmap.yaml
@@ -0,0 +1,69 @@
+# Brings kube-system/coredns's Corefile under GitOps management. It was
+# previously only ever edited live via kubectl (3 existing rewrite rules
+# for auth/rancher/netbird.kube.huskypup.net, none of them git-tracked
+# anywhere in this repo) - every future change meant a manual,
+# classifier-gated live edit to a cluster-wide DNS config instead of a
+# normal git commit ArgoCD applies on its own. No Talos/kubeadm
+# ownerReferences on this ConfigMap or the coredns Deployment (confirmed
+# live 2026-08-20), so it's safe to take over here.
+#
+# No pod restart needed after a sync - the Corefile's own `reload` plugin
+# (already present below) watches the mounted file and hot-reloads within
+# ~30-60s of the ConfigMap volume actually updating on disk (kubelet
+# propagates ConfigMap changes to mounted volumes automatically, typically
+# within ~60-90s).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+            lameduck 5s
+        }
+        ready
+        log . {
+            class error
+        }
+        prometheus :9153
+
+        # Rewrite auth.kube.huskypup.net to ingress gateway (NOT authentik-server directly)
+        # This ensures HTTPS works because the ingress gateway has the wildcard TLS cert.
+        # The old rewrite to authentik-server caused TLS failures for OIDC token exchange.
+        rewrite name auth.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local
+
+        # Rewrite rancher.kube.huskypup.net to internal Istio ingress gateway
+        rewrite name rancher.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local
+
+        # Rewrite netbird.kube.huskypup.net to internal Istio ingress gateway
+        rewrite name netbird.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local
+
+        # Multi-site active failover pilot (see
+        # /home/scooby/.claude/plans/jiggly-snacking-iverson.md): home's
+        # own pods resolving the floating pg-authentik.ha.huskypup.net
+        # record always go straight to the local CNPG -rw service instead
+        # of round-tripping out through the UniFi WAN port-forward and
+        # back in - this UniFi doesn't support NAT hairpin/loopback for
+        # its own forwarded ports (confirmed live 2026-08-20: DNS
+        # resolved fine, TCP connect failed).
+        rewrite name pg-authentik.ha.huskypup.net pg-authentik-rw.authentik.svc.cluster.local
+
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+            pods insecure
+            fallthrough in-addr.arpa ip6.arpa
+            ttl 30
+        }
+        forward . 1.1.1.1 8.8.8.8 {
+           max_concurrent 1000
+        }
+        cache 30 {
+           disable success cluster.local
+           disable denial cluster.local
+        }
+        loop
+        reload
+        loadbalance
+    }