diff --git a/argocd/manifests/tailscale-operator/endpoints-forge.yaml b/argocd/manifests/tailscale-operator/endpoints-forge.yaml
index 0eac8ab..e68aff9 100644
--- a/argocd/manifests/tailscale-operator/endpoints-forge.yaml
+++ b/argocd/manifests/tailscale-operator/endpoints-forge.yaml
@@ -1,6 +1,15 @@
 ---
 # Manual Endpoints pointing to indri's Tailscale IP for the
 # forge-external Service. Must match the Service name exactly.
+#
+# NOTE: ArgoCD excludes all Endpoints resources (resource.exclusions in
+# argocd-cm) because they are normally auto-managed by the control plane.
+# This manual Endpoints is the exception — it must be applied directly
+# with kubectl, not via ArgoCD. It is listed in kustomization.yaml for
+# documentation purposes only; ArgoCD will silently skip it.
+#
+#   kubectl --context=minikube-indri apply -f endpoints-forge.yaml
+#
 apiVersion: v1
 kind: Endpoints
 metadata:
diff --git a/argocd/manifests/tailscale-operator/kustomization.yaml b/argocd/manifests/tailscale-operator/kustomization.yaml
index 9b3f453..f1d6f89 100644
--- a/argocd/manifests/tailscale-operator/kustomization.yaml
+++ b/argocd/manifests/tailscale-operator/kustomization.yaml
@@ -9,5 +9,8 @@ resources:
   - proxygroup-ingress.yaml
   - external-secret.yaml
   - svc-forge-external.yaml
-  - endpoints-forge.yaml
+  # endpoints-forge.yaml is NOT managed by ArgoCD — Endpoints are globally
+  # excluded in argocd-cm resource.exclusions (too noisy for auto-managed
+  # Endpoints). Apply manually:
+  #   kubectl --context=minikube-indri apply -f endpoints-forge.yaml
   - ingress-forge.yaml