diff --git a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
index 7318bb3..6d370af 100644
--- a/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
+++ b/helm-overrides/k8s-admin-prd-ase1/gitea/custom-values.yaml
@@ -64,6 +64,17 @@ gitea:
         DB_TYPE: sqlite3
       actions:
         ENABLED: true
+      security:
+        # Gitea's own SSRF protection blocks outbound webhook calls to
+        # private/internal IPs by default — hit this trying to fire a
+        # webhook at jenkins.192.168.1.7.nip.io ("webhook can only call
+        # allowed HTTP servers"). Everything on this homelab lives on a
+        # private LAN, so a narrow allowlist would just mean editing
+        # this every time a new *.192.168.1.7.nip.io/*.100.90.248.118.nip.io
+        # host needs webhook access — matches the lightweight security
+        # posture already used elsewhere here (ArgoCD --insecure, plain
+        # HTTP throughout).
+        ALLOWED_HOST_LIST: "*"
     admin:
       username: gitadmin
       # The running install set this via a plaintext --set-string flag at