diff --git a/argocd/manifests/tailscale-operator/svc-forge-external.yaml b/argocd/manifests/tailscale-operator/svc-forge-external.yaml
index 2812acf..9dbcade 100644
--- a/argocd/manifests/tailscale-operator/svc-forge-external.yaml
+++ b/argocd/manifests/tailscale-operator/svc-forge-external.yaml
@@ -1,13 +1,28 @@
 ---
+# Headless service + manual Endpoints to route to Forgejo on indri.
+# ExternalName services don't have a ClusterIP, which the Tailscale
+# ingress operator requires. This pattern creates a real ClusterIP
+# that forwards to indri's Tailscale IP.
 apiVersion: v1
 kind: Service
 metadata:
   name: forge-external
   namespace: tailscale
 spec:
-  type: ExternalName
-  externalName: indri.tail8d86e.ts.net
   ports:
     - name: http
       port: 3001
       protocol: TCP
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: forge-external
+  namespace: tailscale
+subsets:
+  - addresses:
+      - ip: 100.98.163.89
+    ports:
+      - name: http
+        port: 3001
+        protocol: TCP