diff --git a/argocd-patches/redis-patch.yaml b/argocd-patches/redis-patch.yaml
index bd28817..e7244bf 100644
--- a/argocd-patches/redis-patch.yaml
+++ b/argocd-patches/redis-patch.yaml
@@ -1,3 +1,11 @@
+# PARCHE PARCIAL, no un manifiesto completo: sólo lleva los campos que hay que
+# volver a poner encima de los manifiestos oficiales de ArgoCD tras cada
+# actualización. El anclaje a chemavx-k8 y los límites evitan que este pod
+# muera con Exit Code 255 tras varios días de uptime.
+#
+# El estado completo y real está en argocd/deployment-argocd-redis.yaml.
+# No compares este fichero con el cluster: le faltan a propósito el initContainer
+# secret-init y la env REDIS_PASSWORD, que vienen de los manifiestos de ArgoCD.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/argocd/deployment-argocd-redis.yaml b/argocd/deployment-argocd-redis.yaml
index ab66fed..f7f9a5b 100644
--- a/argocd/deployment-argocd-redis.yaml
+++ b/argocd/deployment-argocd-redis.yaml
@@ -1,12 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    deployment.kubernetes.io/revision: '1'
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"app.kubernetes.io/component":"redis","app.kubernetes.io/name":"argocd-redis","app.kubernetes.io/part-of":"argocd"},"name":"argocd-redis","namespace":"argocd"},"spec":{"selector":{"matchLabels":{"app.kubernetes.io/name":"argocd-redis"}},"template":{"metadata":{"labels":{"app.kubernetes.io/name":"argocd-redis"}},"spec":{"affinity":{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchLabels":{"app.kubernetes.io/name":"argocd-redis"}},"topologyKey":"kubernetes.io/hostname"},"weight":100},{"podAffinityTerm":{"labelSelector":{"matchLabels":{"app.kubernetes.io/part-of":"argocd"}},"topologyKey":"kubernetes.io/hostname"},"weight":5}]}},"containers":[{"args":["--save","","--appendonly","no","--requirepass
-      $(REDIS_PASSWORD)"],"env":[{"name":"REDIS_PASSWORD","valueFrom":{"secretKeyRef":{"key":"auth","name":"argocd-redis"}}}],"image":"public.ecr.aws/docker/library/redis:8.2.3-alpine","imagePullPolicy":"Always","name":"redis","ports":[{"containerPort":6379}],"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}}],"initContainers":[{"command":["argocd","admin","redis-initial-password"],"image":"quay.io/argoproj/argocd:v3.3.6","imagePullPolicy":"IfNotPresent","name":"secret-init","securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}}],"nodeSelector":{"kubernetes.io/os":"linux"},"securityContext":{"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}},"serviceAccountName":"argocd-redis"}}}}
-
-      '
   labels:
     app.kubernetes.io/component: redis
     app.kubernetes.io/name: argocd-redis
@@ -64,7 +58,13 @@ spec:
         ports:
         - containerPort: 6379
           protocol: TCP
-        resources: {}
+        resources:
+          limits:
+            cpu: 200m
+            memory: 128Mi
+          requests:
+            cpu: 50m
+            memory: 64Mi
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -94,8 +94,13 @@ spec:
             type: RuntimeDefault
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
+      # NO es el nodeSelector por defecto de ArgoCD. Anclado a mano al
+      # control-plane, junto con los límites de recursos del contenedor:
+      # sin ello este pod muere con Exit Code 255 tras varios días de
+      # uptime. Ver argocd-patches/redis-patch.yaml, que documenta el
+      # parche para volver a aplicarlo tras actualizar ArgoCD.
       nodeSelector:
-        kubernetes.io/os: linux
+        kubernetes.io/hostname: chemavx-k8
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext:
@@ -106,4 +111,3 @@ spec:
       serviceAccount: argocd-redis
       serviceAccountName: argocd-redis
       terminationGracePeriodSeconds: 30
-
diff --git a/cluster-wide/namespaces.yaml b/cluster-wide/namespaces.yaml
index b42d43b..30e4261 100644
--- a/cluster-wide/namespaces.yaml
+++ b/cluster-wide/namespaces.yaml
@@ -1,10 +1,14 @@
+# Namespaces creados a mano. NO es la lista completa del cluster: los de las
+# apps de ArgoCD los crea el propio ArgoCD (16 llevan CreateNamespace=true) y
+# no aparecen aquí. Aplicar este fichero no reconstruye el cluster.
+#
+# 2026-07-22: fuera polymarket-bot, decomisado el 2026-07-17. Ojo: backup-system
+# y n8n siguen listados aunque ya son apps de ArgoCD — quedan de cuando se
+# gestionaban a mano; son inofensivos porque el namespace ya existe.
+---
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"argocd"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: argocd
   name: argocd
@@ -15,10 +19,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"authentik"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: authentik
   name: authentik
@@ -29,10 +29,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"backup-system"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: backup-system
   name: backup-system
@@ -43,10 +39,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"cert-manager"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: cert-manager
   name: cert-manager
@@ -57,10 +49,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"cloudflare-ddns"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: cloudflare-ddns
   name: cloudflare-ddns
@@ -81,10 +69,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"gitea"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: gitea
   name: gitea
@@ -95,10 +79,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"homarr"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: homarr
   name: homarr
@@ -109,10 +89,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"monitoring"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: monitoring
   name: monitoring
@@ -123,10 +99,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"n8n"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: n8n
   name: n8n
@@ -137,24 +109,6 @@ spec:
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"polymarket-bot"},"spec":{},"status":{}}
-
-      '
-  labels:
-    kubernetes.io/metadata.name: polymarket-bot
-  name: polymarket-bot
-spec:
-  finalizers:
-  - kubernetes
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  annotations:
-    kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"name":"vaultwarden"},"spec":{},"status":{}}
-
-      '
   labels:
     kubernetes.io/metadata.name: vaultwarden
   name: vaultwarden
diff --git a/gitea/configmap-buildkitd-config.yaml b/gitea/configmap-buildkitd-config.yaml
new file mode 100644
index 0000000..7063dc4
--- /dev/null
+++ b/gitea/configmap-buildkitd-config.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+data:
+  buildkitd.toml: |
+    [registry."registry-cache.registry-cache.svc.cluster.local:5000"]
+      http = true
+      insecure = true
+
+    [registry."gitea.gitea.svc.cluster.local:3000"]
+      http = true
+      insecure = true
+kind: ConfigMap
+metadata:
+  name: buildkitd-config
+  namespace: gitea
diff --git a/gitea/configmap-daemon-json.yaml b/gitea/configmap-daemon-json.yaml
index 1966735..cbddcca 100644
--- a/gitea/configmap-daemon-json.yaml
+++ b/gitea/configmap-daemon-json.yaml
@@ -1,11 +1,7 @@
 apiVersion: v1
+data:
+  daemon.json: '{"registry-mirrors":["http://registry-cache.registry-cache.svc.cluster.local:5000"],"insecure-registries":["registry-cache.registry-cache.svc.cluster.local:5000","git.chemavx.xyz","gitea.gitea.svc.cluster.local:3000"]}'
 kind: ConfigMap
 metadata:
   name: docker-daemon-config
   namespace: gitea
-data:
-  daemon.json: |
-    {
-      "registry-mirrors": ["http://registry-cache.registry-cache.svc.cluster.local:5000"],
-      "insecure-registries": ["registry-cache.registry-cache.svc.cluster.local:5000"]
-    }
diff --git a/monitoring/daemonset-kube-prometheus-stack-prometheus-node-exporter.yaml b/monitoring/daemonset-kube-prometheus-stack-prometheus-node-exporter.yaml
index 724ac61..5c9e0bf 100644
--- a/monitoring/daemonset-kube-prometheus-stack-prometheus-node-exporter.yaml
+++ b/monitoring/daemonset-kube-prometheus-stack-prometheus-node-exporter.yaml
@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   annotations:
-    deprecated.daemonset.template.generation: '1'
     meta.helm.sh/release-name: kube-prometheus-stack
     meta.helm.sh/release-namespace: monitoring
   labels:
@@ -140,4 +139,3 @@ spec:
       maxSurge: 0
       maxUnavailable: 1
     type: RollingUpdate
-