diff --git a/README.md b/README.md
index 44f7cc9..63f5d6f 100644
--- a/README.md
+++ b/README.md
@@ -206,7 +206,7 @@ The Kubernetes path accepts a `nodes` list containing any number of control-plan
 
 11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence.
 
-Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Confirm the LAN interface and address pool before enabling production LoadBalancer services. Longhorn also requires a validated disk or mount on the storage node.
+Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is `10.0.0.10–10.0.0.89`, announced over `enp1s0` with an L2 announcement policy. Keep that range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes. Longhorn also requires a validated disk or mount on the storage node.
 
 The Terraform Talos provider uses one generated machine-secrets bundle for the whole node list. If the nodes were previously configured with another Talos CA, reset/reinstall them or restore the matching Terraform state before applying. Terraform state contains the generated Talos credentials and must remain private.
 
diff --git a/infrastructure/cilium/templates/l2-announcement-policy.yaml b/infrastructure/cilium/templates/l2-announcement-policy.yaml
new file mode 100644
index 0000000..db3ae01
--- /dev/null
+++ b/infrastructure/cilium/templates/l2-announcement-policy.yaml
@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: loadbalancer-services
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  interfaces:
+    - "^enp1s0$"
+  loadBalancerIPs: true
diff --git a/infrastructure/cilium/templates/loadbalancer-ippool.yaml b/infrastructure/cilium/templates/loadbalancer-ippool.yaml
new file mode 100644
index 0000000..5ebf7b5
--- /dev/null
+++ b/infrastructure/cilium/templates/loadbalancer-ippool.yaml
@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: home-services
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  blocks:
+    - start: 10.0.0.10
+      stop: 10.0.0.89
diff --git a/infrastructure/cilium/values.yaml b/infrastructure/cilium/values.yaml
index 75d4ff5..828e415 100644
--- a/infrastructure/cilium/values.yaml
+++ b/infrastructure/cilium/values.yaml
@@ -43,12 +43,14 @@ cilium:
   externalIPs:
     enabled: true
 
+  ingressController:
+    enabled: true
+    default: false
+    loadbalancerMode: shared
+
   operator:
     replicas: 1
 
   # The LAN interface is enp1s0 on both Talos nodes.
   devices:
     - enp1s0
-
-# Configure a CiliumLoadBalancerIPPool and L2AnnouncementPolicy after
-# confirming the unused address range in the cluster LAN.