diff --git a/k8s-apps/argocd/templates/ingress-cli.yaml b/k8s-apps/argocd/templates/ingress-cli.yaml
index 58fdc6b8..d5fec6b8 100644
--- a/k8s-apps/argocd/templates/ingress-cli.yaml
+++ b/k8s-apps/argocd/templates/ingress-cli.yaml
@@ -4,6 +4,7 @@ metadata:
   name: argocd-cli-ingress
   annotations:
     external-dns.alpha.kubernetes.io/target: home.terence.cloud
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" # 403 on the github actions runner
     nginx.ingress.kubernetes.io/backend-protocol: HTTPS
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     nginx.ingress.kubernetes.io/use-regex: "true"
diff --git a/k8s-apps/argocd/values.yaml b/k8s-apps/argocd/values.yaml
index 01c1e6fe..40f671fc 100644
--- a/k8s-apps/argocd/values.yaml
+++ b/k8s-apps/argocd/values.yaml
@@ -343,6 +343,7 @@ argo-cd:
       enabled: true
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt
+        external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" # 403 on the github actions runner
         cert-manager.io/issue-temporary-certificate: "true"
         external-dns.alpha.kubernetes.io/target: home.terence.cloud
         nginx.ingress.kubernetes.io/force-ssl-redirect: "true"