diff --git a/argocd/apps/argocd-self.yaml b/argocd/apps/argocd-self.yaml
new file mode 100644
index 0000000..74c968a
--- /dev/null
+++ b/argocd/apps/argocd-self.yaml
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    targetRevision: main
+    path: argocd/values
+    helm:
+      chart: argo-cd
+      repo: https://argoproj.github.io/argo-helm
+      version: 9.4.15
+      valueFiles:
+        - argocd.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: false      # never auto-delete ArgoCD itself
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
\ No newline at end of file
diff --git a/argocd/values/argocd.yaml b/argocd/values/argocd.yaml
new file mode 100644
index 0000000..70c4fa5
--- /dev/null
+++ b/argocd/values/argocd.yaml
@@ -0,0 +1,27 @@
+# helm install argocd argo/argo-cd \
+#   --namespace argocd --create-namespace \
+#   --version 9.4.15 \
+#   --values argocd/values/argocd.yaml
+global:
+  domain: argocd.home.arpa
+
+configs:
+  params:
+  # Traefik terminates TLS, ArgoCD speaks plain HTTP internally
+    server.insecure: "true"
+
+server:
+  ingress:
+    enabled: false
+
+redis-ha:
+  enabled: false
+
+controller:
+  replicas: 1
+
+repoServer:
+  replicas: 1
+
+applicationSet:
+  replicas: 1
\ No newline at end of file
diff --git a/manifests/argocd/app-of-apps.yaml b/manifests/argocd/app-of-apps.yaml
new file mode 100644
index 0000000..fb5682d
--- /dev/null
+++ b/manifests/argocd/app-of-apps.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: app-of-apps
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.nik4nao.com/nik/homelab.git
+    targetRevision: main
+    path: argocd/apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
\ No newline at end of file
diff --git a/manifests/argocd/argocd.yaml b/manifests/argocd/argocd.yaml
new file mode 100644
index 0000000..5dfd84f
--- /dev/null
+++ b/manifests/argocd/argocd.yaml
@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: argocd-tls
+  namespace: argocd
+spec:
+  secretName: argocd-tls
+  issuerRef:
+    name: internal-ca-issuer
+    kind: ClusterIssuer
+  dnsNames:
+    - argocd.home.arpa
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`argocd.home.arpa`)
+      kind: Rule
+      services:
+        - name: argocd-server
+          port: 80
+  tls:
+    secretName: argocd-tls
\ No newline at end of file
diff --git a/values/pihole-debian.yaml b/values/pihole-debian.yaml
index 6cd0787..cba82b2 100644
--- a/values/pihole-debian.yaml
+++ b/values/pihole-debian.yaml
@@ -47,6 +47,8 @@ dnsmasq:
     - address=/traefik.home.arpa/192.168.7.77
     - address=/photoview.home.arpa/192.168.7.77
     - address=/gitea.nik4nao.com/192.168.7.77
+    - address=/ha.home.arpa/192.168.7.77
+    - address=/argocd.home.arpa/192.168.7.77
 
 persistentVolumeClaim:
   enabled: true
diff --git a/values/pihole.yaml b/values/pihole.yaml
index e59ea8f..6c329b5 100644
--- a/values/pihole.yaml
+++ b/values/pihole.yaml
@@ -78,4 +78,5 @@ dnsmasq:
     - address=/traefik.home.arpa/192.168.7.77
     - address=/photoview.home.arpa/192.168.7.77
     - address=/gitea.nik4nao.com/192.168.7.77
-    - address=/ha.home.arpa/192.168.7.77
\ No newline at end of file
+    - address=/ha.home.arpa/192.168.7.77
+    - address=/argocd.home.arpa/192.168.7.77
\ No newline at end of file