diff --git a/kubernetes/apps-foundry/argocd-server-ingress.yaml b/kubernetes/apps-foundry/argocd-server-ingress.yaml
new file mode 100644
index 0000000..c359283
--- /dev/null
+++ b/kubernetes/apps-foundry/argocd-server-ingress.yaml
@@ -0,0 +1,29 @@
+# Public Ingress for argocd.gauchoracing.com on the foundry cluster.
+# Same pattern as sentinel — Traefik + external-dns + tunnel.
+#
+# The ArgoCD install itself is managed outside GitOps (kubectl-applied
+# from the upstream install manifest on foundry). This Application only
+# owns the public Ingress resource.
+
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-server-ingress
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Gaucho-Racing/infrastructure.git
+    targetRevision: main
+    path: kubernetes/manifests-foundry/argocd-server-ingress
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
diff --git a/kubernetes/manifests-foundry/argocd-server-ingress/ingress.yaml b/kubernetes/manifests-foundry/argocd-server-ingress/ingress.yaml
new file mode 100644
index 0000000..4a82c8f
--- /dev/null
+++ b/kubernetes/manifests-foundry/argocd-server-ingress/ingress.yaml
@@ -0,0 +1,32 @@
+# Public Ingress for the foundry cluster's ArgoCD UI at
+# argocd.gauchoracing.com. Traefik receives HTTP forwarded by the
+# cloudflared tunnel; TLS terminates at the Cloudflare edge.
+#
+# argocd-server serves plain HTTP on port 80 → targetPort 8080, so no
+# `server.insecure` patch is needed on the existing foundry ArgoCD install.
+#
+# DNS is managed by the foundry external-dns instance:
+#   - hostname derived from spec.rules[].host
+#   - cloudflare-proxied annotation flips the CF record orange
+#   - target is the gr-foundry tunnel via external-dns --default-targets
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-server-public
+  namespace: argocd
+  annotations:
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: argocd.gauchoracing.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80