diff --git a/kubernetes/apps/default/echo-server/app/helmrelease.yaml b/kubernetes/apps/default/echo-server/app/helmrelease.yaml
index f620ae85..6d417c0b 100644
--- a/kubernetes/apps/default/echo-server/app/helmrelease.yaml
+++ b/kubernetes/apps/default/echo-server/app/helmrelease.yaml
@@ -23,7 +23,7 @@ spec:
       retries: 3
   values:
     controller:
-      replicas: 3
+      replicas: 1
       strategy: RollingUpdate
     image:
       repository: docker.io/jmalloc/echo-server
@@ -53,10 +53,10 @@ spec:
         enabled: true
         ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-staging"
+          cert-manager.io/cluster-issuer: letsencrypt-staging
           external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
-          external-dns/is-public: "true"
-          hajimari.io/icon: "video-input-antenna"
+          external-dns.home.arpa/enabled: "true"
+          hajimari.io/icon: video-input-antenna
         hosts:
           - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
             paths:
diff --git a/kubernetes/apps/default/hajimari/app/helmrelease.yaml b/kubernetes/apps/default/hajimari/app/helmrelease.yaml
index ec22e5c8..aef6b8e8 100644
--- a/kubernetes/apps/default/hajimari/app/helmrelease.yaml
+++ b/kubernetes/apps/default/hajimari/app/helmrelease.yaml
@@ -41,8 +41,9 @@ spec:
         enabled: true
         ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-staging"
-          nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+          cert-manager.io/cluster-issuer: letsencrypt-staging
+          nginx.ingress.kubernetes.io/whitelist-source-range: |
+            10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
           hajimari.io/enable: "false"
         hosts:
           - host: &host "hajimari.${SECRET_DOMAIN}"
@@ -54,7 +55,7 @@ spec:
               - *host
             secretName: hajimari-tls
     podAnnotations:
-      configmap.reloader.stakater.com/reload: "hajimari-settings"
+      configmap.reloader.stakater.com/reload: hajimari-settings
     persistence:
       data:
         enabled: true
diff --git a/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
index 7657cc97..d999baab 100644
--- a/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
+++ b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
@@ -5,9 +5,10 @@ metadata:
   name: webhook-receiver
   namespace: flux-system
   annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-staging"
-    external-dns/is-public: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-staging
     external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
+    external-dns.home.arpa/enabled: "true"
+    hajimari.io/enable: "false"
 spec:
   ingressClassName: nginx
   rules:
diff --git a/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
index 420af895..37880835 100644
--- a/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
+++ b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
@@ -29,7 +29,10 @@ spec:
       enabled: true
       className: nginx
       annotations:
-        hajimari.io/icon: "sawtooth-wave"
+        cert-manager.io/cluster-issuer: letsencrypt-staging
+        nginx.ingress.kubernetes.io/whitelist-source-range: |
+          10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+        hajimari.io/icon: sawtooth-wave
       hosts:
         - host: &host "gitops.${SECRET_DOMAIN}"
           paths:
@@ -38,6 +41,7 @@ spec:
       tls:
         - hosts:
             - *host
+          secretName: weave-gitops-tls
     networkPolicy:
       create: false
     metrics: