diff --git a/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml
index 6bb5f19..01171c6 100644
--- a/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml
+++ b/helm-overrides/k8s-admin-prd-ase1/contour/custom-values.yaml
@@ -8,11 +8,20 @@ contour:
   # got a floating IP fine, but this VM's host (VMware Workstation, Bridged
   # networking, over Wi-Fi) doesn't do true MAC-level bridging, so the IP
   # was never reachable from outside the VM. hostPort on Envoy binds
-  # directly to the node's real NIC instead — confirmed working by the live
-  # DaemonSet's actual container ports (checked before writing this file,
-  # not assumed): envoy container has hostPort 80/443 exactly matching
-  # envoy.hostPorts below, so this really is Helm-values-driven, not a
-  # hidden out-of-band kubectl patch.
+  # directly to the node's real NIC instead.
+  #
+  # Correction from an earlier version of this file: the keys below are
+  # NOT what `helm get values` showed as "user-supplied" on the live
+  # release (envoy.hostNetworking / envoy.hostPorts.enabled). Checked
+  # directly against this chart's own values.yaml — this version reads
+  # envoy.hostNetwork (singular) and envoy.useHostPort.http/https instead.
+  # Helm doesn't validate unknown keys, so the old ones were silent no-ops.
+  # hostPort on the live pods is actually coming from the raw `kubectl
+  # patch` in claude.md issue #7 ("the actual working solution" — that
+  # title is the tell), applied completely outside Helm. Getting the real
+  # keys into this file is what finally makes hostPort GitOps-managed
+  # instead of an unmanaged patch any future plain `helm upgrade` could
+  # silently wipe.
   #
   # This is also why ArgoCD's default Ingress health check needed
   # overriding (see argocd-admin-prd/custom-values.yaml) — there's no
@@ -29,9 +38,13 @@ contour:
 
   envoy:
     dnsPolicy: ClusterFirstWithHostNet
-    hostNetworking: true
+    hostNetwork: true
+    useHostPort:
+      http: true
+      https: true
+    # Already the chart default (80/443) — pinned explicitly anyway so a
+    # future chart bump changing its defaults can't silently change this.
     hostPorts:
-      enabled: true
       http: 80
       https: 443
     resources: