diff --git a/argocd/manifests/databases/service-tailscale.yaml b/argocd/manifests/databases/service-tailscale.yaml
index 8e3d1d0..ab69280 100644
--- a/argocd/manifests/databases/service-tailscale.yaml
+++ b/argocd/manifests/databases/service-tailscale.yaml
@@ -8,7 +8,6 @@ metadata:
   namespace: databases
   annotations:
     tailscale.com/hostname: "k8s-pg"
-    tailscale.com/proxy-class: "default"
 spec:
   type: LoadBalancer
   loadBalancerClass: tailscale
diff --git a/argocd/manifests/tailscale-operator/proxyclass.yaml b/argocd/manifests/tailscale-operator/proxyclass.yaml
index 9b88262..2704872 100644
--- a/argocd/manifests/tailscale-operator/proxyclass.yaml
+++ b/argocd/manifests/tailscale-operator/proxyclass.yaml
@@ -2,15 +2,15 @@
 # CRI-O cannot resolve short image names, so we must use fully-qualified references.
 # This ProxyClass sets the tailscale container images to use docker.io prefix.
 #
-# Apply this after operator.yaml. Services should reference this via:
-#   annotations:
-#     tailscale.com/proxy-class: "default"
+# With `default: true`, this ProxyClass is automatically applied to all
+# Services/Ingresses that don't explicitly specify a different proxy-class.
 ---
 apiVersion: tailscale.com/v1alpha1
 kind: ProxyClass
 metadata:
   name: default
 spec:
+  default: true
   statefulSet:
     pod:
       tailscaleContainer: