diff --git a/infra/argo/cockpit-build-deploy.yaml b/infra/argo/cockpit-build-deploy.yaml
index 7798edf..287dbdb 100644
--- a/infra/argo/cockpit-build-deploy.yaml
+++ b/infra/argo/cockpit-build-deploy.yaml
@@ -33,7 +33,8 @@ spec:
 
     # --- build: Kaniko builds infra/docker/fxhnt.Dockerfile -> internal registry ---
     - name: kaniko-build
-      archiveLocation: { archiveLogs: false }   # ci-compile-cpu can't reach MinIO; spec-level archiveLogs isn't honored — override per-template so the wait sidecar doesn't fail the build
+      metadata:
+        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allows part-of in {foxhunt,foxhunt-ci,argo-workflows} → log archival works. NOT 'foxhunt' (that adds argo-base-egress which blocks registry:5000/git:2222).
       nodeSelector: { k8s.scaleway.com/pool-name: ci-compile-cpu, topology.kubernetes.io/zone: fr-par-2 }
       tolerations: [{ effect: NoSchedule, key: node.cilium.io/agent-not-ready, operator: Exists }]
       initContainers:
@@ -84,7 +85,8 @@ spec:
 
     # --- deploy: apply manifests from the repo + roll the dashboard to the fresh image ---
     - name: kubectl-deploy
-      archiveLocation: { archiveLogs: false }   # same: don't fail the deploy on the unreachable MinIO log sink
+      metadata:
+        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allow → log archival works (see kaniko-build note)
       nodeSelector: { k8s.scaleway.com/pool-name: platform, topology.kubernetes.io/zone: fr-par-2 }
       serviceAccountName: argo-workflow
       initContainers: