diff --git a/gitops/workloads/authelia/pvc.yaml b/gitops/workloads/authelia/pvc.yaml
new file mode 100644
index 0000000..54855f6
--- /dev/null
+++ b/gitops/workloads/authelia/pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-data
+  namespace: authelia
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/gitops/workloads/coredns-custom/configmap.yaml b/gitops/workloads/coredns-custom/configmap.yaml
index ba3e9bd..9327284 100644
--- a/gitops/workloads/coredns-custom/configmap.yaml
+++ b/gitops/workloads/coredns-custom/configmap.yaml
@@ -1,7 +1,7 @@
 # Extends k3s CoreDNS with:
 # 1. Wildcard zone for *.apps.lab.home.arpa → 192.168.1.160 (Traefik ingress).
-# 2. Forward zone for lab.home.arpa → lab DNS servers (dnsmasq on OPi Zero 2W nodes).
-#    This lets pods resolve any *.lab.home.arpa hostname (e.g. cores3, h4-core, opi5pro-1).
+# 2. Forward zone for lab.home.arpa → lab DNS servers (Pi-hole + dnsmasq secondaries).
+#    This lets pods resolve any *.lab.home.arpa hostname (e.g. gitlab, cores3, h4-core).
 #    apps.lab.home.arpa is more specific and wins over the forward zone for ingress names.
 apiVersion: v1
 kind: ConfigMap
@@ -21,11 +21,3 @@ data:
         forward . 192.168.1.184 192.168.1.217
         cache 30
     }
-  gitlab.server: |
-    gitlab.lab.home.arpa:53 {
-        hosts {
-            192.168.1.50 gitlab.lab.home.arpa
-            fallthrough
-        }
-        cache 30
-    }