diff --git a/infra/k8s/gitlab/tailscale-proxy.yaml b/infra/k8s/gitlab/tailscale-proxy.yaml
new file mode 100644
index 000000000..fd4a2a3c4
--- /dev/null
+++ b/infra/k8s/gitlab/tailscale-proxy.yaml
@@ -0,0 +1,147 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tailscale-gitlab
+  namespace: foxhunt
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tailscale-gitlab
+  namespace: foxhunt
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create", "get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tailscale-gitlab
+  namespace: foxhunt
+subjects:
+  - kind: ServiceAccount
+    name: tailscale-gitlab
+    namespace: foxhunt
+roleRef:
+  kind: Role
+  name: tailscale-gitlab
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tailscale-gitlab-proxy
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: tailscale-gitlab-proxy
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tailscale-gitlab-proxy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tailscale-gitlab-proxy
+    spec:
+      serviceAccountName: tailscale-gitlab
+      nodeSelector:
+        k8s.scaleway.com/pool-name: gitlab
+      tolerations:
+        - key: gitlab
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      containers:
+        - name: nginx
+          image: nginx:alpine
+          ports:
+            - containerPort: 80
+            - containerPort: 443
+            - containerPort: 5050
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+        - name: tailscale
+          image: ghcr.io/tailscale/tailscale:latest
+          env:
+            - name: TS_AUTHKEY
+              valueFrom:
+                secretKeyRef:
+                  name: tailscale-auth
+                  key: TS_AUTHKEY
+            - name: TS_KUBE_SECRET
+              value: tailscale-gitlab-state
+            - name: TS_USERSPACE
+              value: "false"
+            - name: TS_HOSTNAME
+              value: "foxhunt-gitlab"
+            - name: TS_ACCEPT_DNS
+              value: "false"
+            - name: TS_EXTRA_ARGS
+              value: ""
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+                - NET_RAW
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: tailscale-gitlab-nginx
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tailscale-gitlab-nginx
+  namespace: foxhunt
+data:
+  default.conf: |
+    server {
+        listen 80;
+        server_name git.fxhnt.ai;
+
+        client_max_body_size 250m;
+
+        location / {
+            proxy_pass http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    server {
+        listen 5050;
+        server_name git.fxhnt.ai;
+
+        client_max_body_size 0;
+
+        location / {
+            proxy_pass http://gitlab-registry.foxhunt.svc.cluster.local:5000;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
diff --git a/infra/k8s/gitlab/values.yaml b/infra/k8s/gitlab/values.yaml
index c2209e3c8..3eabe1d8b 100644
--- a/infra/k8s/gitlab/values.yaml
+++ b/infra/k8s/gitlab/values.yaml
@@ -26,8 +26,10 @@ global:
   redis:
     host: redis.foxhunt.svc.cluster.local
     port: 6379
-    password:
+    auth:
       enabled: false
+  minio:
+    enabled: false
   registry:
     bucket: foxhunt-gitlab-registry
   appConfig:
@@ -59,21 +61,22 @@ redis:
   install: false
 
 # Disable components we don't need
+installCertmanager: false
 certmanager:
-  install: false
+  installCRDs: false
 nginx-ingress:
   enabled: false
 prometheus:
   install: false
-grafana:
-  install: false
 gitlab-runner:
   install: false
-minio:
-  install: false
 
 # Registry — S3-backed
 registry:
+  replicaCount: 1
+  hpa:
+    minReplicas: 1
+    maxReplicas: 1
   storage:
     secret: gitlab-s3-credentials
     key: registry
@@ -89,6 +92,9 @@ registry:
 gitlab:
   webservice:
     replicaCount: 1
+    hpa:
+      minReplicas: 1
+      maxReplicas: 1
     workerProcesses: 2
     nodeSelector:
       k8s.scaleway.com/pool-name: gitlab
@@ -109,6 +115,9 @@ gitlab:
 
   sidekiq:
     replicas: 1
+    hpa:
+      minReplicas: 1
+      maxReplicas: 1
     concurrency: 10
     nodeSelector:
       k8s.scaleway.com/pool-name: gitlab
@@ -147,6 +156,10 @@ gitlab:
         memory: 2Gi
 
   gitlab-shell:
+    replicaCount: 1
+    hpa:
+      minReplicas: 1
+      maxReplicas: 1
     nodeSelector:
       k8s.scaleway.com/pool-name: gitlab
     tolerations:
@@ -159,6 +172,11 @@ gitlab:
       nodePort: 32222
 
   toolbox:
+    backups:
+      objectStorage:
+        config:
+          secret: gitlab-s3-credentials
+          key: connection
     nodeSelector:
       k8s.scaleway.com/pool-name: gitlab
     tolerations:
@@ -169,6 +187,9 @@ gitlab:
 
   kas:
     enabled: false
+    hpa:
+      minReplicas: 0
+      maxReplicas: 0
 
   gitlab-exporter:
     enabled: false
diff --git a/infra/live/production/dns/terragrunt.hcl b/infra/live/production/dns/terragrunt.hcl
index 9fd912045..e9e9e3ff7 100644
--- a/infra/live/production/dns/terragrunt.hcl
+++ b/infra/live/production/dns/terragrunt.hcl
@@ -8,7 +8,6 @@ terraform {
 
 inputs = {
   dns_zone  = "fxhnt.ai"
-  # Tailscale subnet router IP — GitLab CE is accessed via this
-  # Update this after deploying GitLab and finding the routable IP
-  git_ip = "PLACEHOLDER_UPDATE_AFTER_DEPLOY"
+  # Tailscale IP of foxhunt-gitlab proxy pod
+  git_ip = "100.90.76.85"
 }