diff --git a/app-of-extra-manifests.yaml b/app-of-extra-manifests.yaml
new file mode 100644
index 0000000..e1cb1d3
--- /dev/null
+++ b/app-of-extra-manifests.yaml
@@ -0,0 +1,29 @@
+# Bootstrap Application, applied once by hand (like app-of-projects.yaml
+# and app-of-secretstores.yaml) — ArgoCD can't sync its own entry points.
+# General-purpose spot for occasional raw Kubernetes manifests that don't
+# fit the Helm-chart-per-app pattern this repo otherwise uses, and don't
+# belong under secretstores/ (that one's scoped to External Secrets
+# Operator resources specifically). First use: a second Ingress for
+# Harbor's Tailscale hostname, since that chart has no multi-host support
+# of its own to hang it off.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: app-of-extra-manifests
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: 'http://gitea.192.168.1.7.nip.io/mukul/devops-infra-argo-config.git'
+    targetRevision: main
+    path: extra-manifests
+    directory:
+      recurse: true
+  destination:
+    name: in-cluster
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
diff --git a/extra-manifests/harbor-ingress-tailscale.yaml b/extra-manifests/harbor-ingress-tailscale.yaml
new file mode 100644
index 0000000..3724eaa
--- /dev/null
+++ b/extra-manifests/harbor-ingress-tailscale.yaml
@@ -0,0 +1,24 @@
+# Harbor's chart has no multi-host mechanism at all (checked against the
+# actual template — no extraHosts like argo-cd, no secondaryingress like
+# jenkins). This is a standalone second Ingress routing the Tailscale
+# hostname to the same backend the chart's own Ingress uses
+# (harbor-core:80) — confirmed against the real rendered Service, not
+# assumed.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: harbor-ingress-tailscale
+  namespace: harbor
+spec:
+  ingressClassName: contour
+  rules:
+    - host: "harbor.100.90.248.118.nip.io"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: harbor-core
+                port:
+                  number: 80
diff --git a/secretstores/harbor-admin-credentials.yaml b/secretstores/harbor-admin-credentials.yaml
new file mode 100644
index 0000000..9b5ffd5
--- /dev/null
+++ b/secretstores/harbor-admin-credentials.yaml
@@ -0,0 +1,21 @@
+# Vault-backed from the start, same as jenkins-admin-credentials. Key name
+# matches what the chart's existingSecretAdminPasswordKey expects — see
+# devops-infra-helm-charts/helm-overrides/k8s-admin-prd-ase1/harbor/custom-values.yaml.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: harbor-admin-credentials
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: harbor-admin-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: HARBOR_ADMIN_PASSWORD
+      remoteRef:
+        key: harbor/admin
+        property: password
diff --git a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
index 52f85c4..f1f8253 100644
--- a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
+++ b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
@@ -101,4 +101,15 @@ appSpec:
     nameOverride: jenkins
     namespace: jenkins
     chartDir: jenkins
-    valuesDir: jenkins
\ No newline at end of file
+    valuesDir: jenkins
+  - name: harbor
+    # Fresh install (helm list -n harbor came back empty despite claude.md
+    # saying otherwise). nameOverride pinned for the same predictability
+    # reason as jenkins — rendered object names all end up prefixed with
+    # this (harbor-core, harbor-registry, etc.), which is also what
+    # Jenkins needs to reference for internal image pushes
+    # (harbor-core.harbor.svc.cluster.local).
+    nameOverride: harbor
+    namespace: harbor
+    chartDir: harbor
+    valuesDir: harbor
\ No newline at end of file