diff --git a/deploy/k8s/10-deployment.yaml b/deploy/k8s/10-deployment.yaml
index 4ec9398..414c0c9 100644
--- a/deploy/k8s/10-deployment.yaml
+++ b/deploy/k8s/10-deployment.yaml
@@ -177,8 +177,8 @@ spec:
     - metadata:
         name: data
       spec:
+        storageClassName: nfs-large
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:
             storage: 4Gi
-        # storageClassName: <your default class>
diff --git a/deploy/k8s/30-ingress.yaml b/deploy/k8s/30-ingress.yaml
index d42ddc9..8e8de67 100644
--- a/deploy/k8s/30-ingress.yaml
+++ b/deploy/k8s/30-ingress.yaml
@@ -12,6 +12,7 @@ metadata:
     k8s-helper.io/group: "Infrastructure"
     k8s-helper.io/icon: "network"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     # SSE (the live query log) is the reason for these three. With response
     # buffering on, nginx holds events until the buffer fills and the log page
     # looks frozen; with a 60s read timeout the stream is cut every minute and
@@ -22,7 +23,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: dns.example.com
+    - host: dns.k6n.net
       http:
         paths:
           # DoH must be matched before the catch-all below, and both are
@@ -50,7 +51,7 @@ spec:
                 port:
                   name: admin
   tls:
-    - hosts: [dns.example.com]
+    - hosts: [dns.k6n.net]
       secretName: fancy-dns-tls
 ---
 # Two replicas means one of them can always be taken away for a node drain.
diff --git a/gitops/README.md b/gitops/README.md
index df85f47..4bd4e4a 100644
--- a/gitops/README.md
+++ b/gitops/README.md
@@ -20,9 +20,10 @@ Configure this repository's Gitea webhook for push events only:
 - Secret: the same value as `K8SHELPER_GITOPS_WEBHOOK_SECRET`
 
 Bootstrap the GitOps resources once with `kubectl apply -f gitops/`. The
-`dns` namespace is declared in the managed kustomization. Before bootstrapping,
-create `fancy-dns-apikey` in `dns` as described in `deploy/k8s/08-secret-apikey.yaml`
-and ensure the cert-manager-managed `fancy-dns-tls` Secret exists. The GitOps
+`dns` namespace is declared in the managed kustomization. Before bootstrapping, create the `fancy-dns-apikey` Secret in `dns` with an
+`api-key` entry. The ingress requests `dns.k6n.net` TLS from the
+`letsencrypt-prod` ClusterIssuer and cert-manager creates `fancy-dns-tls`. The
+StatefulSet PVCs use the `nfs-large` StorageClass. The GitOps
 kustomization intentionally excludes both example Secret manifests so it never
 replaces real credentials or TLS material with placeholders.