diff --git a/k8s/anvil/service-proxysql.yaml b/k8s/anvil/service-proxysql.yaml
index 1a10ac6..70e27fd 100644
--- a/k8s/anvil/service-proxysql.yaml
+++ b/k8s/anvil/service-proxysql.yaml
@@ -1,3 +1,20 @@
+# ProxySQL service pointing to external Incus ProxySQL (192.168.9.140)
+# Endpoints are managed manually (Argo CD excludes Endpoints by default):
+#   kubectl apply -f - <<EOF
+#   apiVersion: v1
+#   kind: Endpoints
+#   metadata:
+#     name: proxysql
+#     namespace: anvil
+#   subsets:
+#   - addresses:
+#     - ip: 192.168.9.140
+#     ports:
+#     - name: mysql
+#       port: 6033
+#     - name: admin
+#       port: 6032
+#   EOF
 apiVersion: v1
 kind: Service
 metadata:
@@ -10,16 +27,3 @@ spec:
   - name: admin
     port: 6032
     targetPort: 6032
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: proxysql
-subsets:
-- addresses:
-  - ip: 192.168.9.140
-  ports:
-  - name: mysql
-    port: 6033
-  - name: admin
-    port: 6032
diff --git a/k8s/ironclad/service-proxysql.yaml b/k8s/ironclad/service-proxysql.yaml
index 1a10ac6..44b7c0e 100644
--- a/k8s/ironclad/service-proxysql.yaml
+++ b/k8s/ironclad/service-proxysql.yaml
@@ -1,3 +1,20 @@
+# ProxySQL service pointing to external Incus ProxySQL (192.168.9.140)
+# Endpoints are managed manually (Argo CD excludes Endpoints by default):
+#   kubectl apply -f - <<EOF
+#   apiVersion: v1
+#   kind: Endpoints
+#   metadata:
+#     name: proxysql
+#     namespace: ironclad
+#   subsets:
+#   - addresses:
+#     - ip: 192.168.9.140
+#     ports:
+#     - name: mysql
+#       port: 6033
+#     - name: admin
+#       port: 6032
+#   EOF
 apiVersion: v1
 kind: Service
 metadata:
@@ -10,16 +27,3 @@ spec:
   - name: admin
     port: 6032
     targetPort: 6032
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: proxysql
-subsets:
-- addresses:
-  - ip: 192.168.9.140
-  ports:
-  - name: mysql
-    port: 6033
-  - name: admin
-    port: 6032