diff --git a/services/adguard/app.yaml b/services/adguard/app.yaml
index 6dfb443..4017f61 100644
--- a/services/adguard/app.yaml
+++ b/services/adguard/app.yaml
@@ -88,7 +88,6 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: adguard-lan-only@kubernetescrd
 spec:
   rules:
   - host: adguard.labzand.com
diff --git a/services/adguard/middleware.yaml b/services/adguard/middleware.yaml
index 553d7f6..040d446 100644
--- a/services/adguard/middleware.yaml
+++ b/services/adguard/middleware.yaml
@@ -1,6 +1,5 @@
-# Middlewares voor adguard.labzand.com (alleen intern):
-# - redirect-https: http (web) -> https
-# - lan-only: blokkeert verkeer van buiten het LAN op de websecure-router
+# Middleware voor adguard.labzand.com: http (web) -> https redirect.
+# (lan-only verwijderd: klipper-lb SNAT't al verkeer naar 10.42.0.1, zie argocd/middleware.yaml)
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -10,14 +9,3 @@ spec:
   redirectScheme:
     scheme: https
     permanent: true
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: lan-only
-  namespace: adguard
-spec:
-  ipAllowList:
-    sourceRange:
-      - 192.168.0.0/16
-      - 127.0.0.1/32
diff --git a/services/argocd/ingress.yaml b/services/argocd/ingress.yaml
index 3b109db..3bb56f0 100644
--- a/services/argocd/ingress.yaml
+++ b/services/argocd/ingress.yaml
@@ -6,7 +6,6 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: argocd-lan-only@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/services/argocd/middleware.yaml b/services/argocd/middleware.yaml
index f5a0486..99a33f9 100644
--- a/services/argocd/middleware.yaml
+++ b/services/argocd/middleware.yaml
@@ -1,6 +1,7 @@
-# Middlewares voor argocd.labzand.com (alleen intern):
-# - redirect-https: http (web) -> https
-# - lan-only: blokkeert verkeer van buiten het LAN op de websecure-router
+# Middleware voor argocd.labzand.com: http (web) -> https redirect.
+# (lan-only ipAllowList verwijderd: k3s klipper-lb SNAT't al LB-verkeer naar
+# 10.42.0.1, waardoor Traefik nooit het echte client-IP ziet. Internal-only
+# wordt afgedwongen via DNS: geen publiek A-record voor interne namen.)
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -10,14 +11,3 @@ spec:
   redirectScheme:
     scheme: https
     permanent: true
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: lan-only
-  namespace: argocd
-spec:
-  ipAllowList:
-    sourceRange:
-      - 192.168.0.0/16
-      - 127.0.0.1/32
diff --git a/services/authentik/ingress.yaml b/services/authentik/ingress.yaml
index a9774f1..9d9264a 100644
--- a/services/authentik/ingress.yaml
+++ b/services/authentik/ingress.yaml
@@ -6,7 +6,6 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: authentik-lan-only@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/services/authentik/middleware-lan.yaml b/services/authentik/middleware-lan.yaml
deleted file mode 100644
index cc995ed..0000000
--- a/services/authentik/middleware-lan.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Middleware voor auth.labzand.com (alleen intern): blokkeert verkeer
-# van buiten het LAN op de websecure-router.
-# (redirect-https staat in redirect.yaml)
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: lan-only
-  namespace: authentik
-spec:
-  ipAllowList:
-    sourceRange:
-      - 192.168.0.0/16
-      - 127.0.0.1/32
diff --git a/services/cloudfare-ddns/configmap.yaml b/services/cloudfare-ddns/configmap.yaml
index cb91946..d645937 100644
--- a/services/cloudfare-ddns/configmap.yaml
+++ b/services/cloudfare-ddns/configmap.yaml
@@ -6,5 +6,8 @@ metadata:
 data:
   # Comma-separated list of domains to update
   # Format: subdomain.domain.tld,subdomain2.domain.tld
-  DOMAINS: "*.labzand.com"
-  ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"
\ No newline at end of file
+  # Alleen namen die écht publiek bereikbaar moeten zijn (via router -> cluster).
+  # Interne-only namen (argocd/auth/adguard.labzand.com) bewust NIET hier:
+  # die krijgen geen publiek A-record en resolven alleen intern via AdGuard.
+  DOMAINS: "ns.labzand.com"
+  ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"