diff --git a/automation/cloudflared-sync.sh b/automation/cloudflared-sync.sh
index ee35dd5..0619740 100644
--- a/automation/cloudflared-sync.sh
+++ b/automation/cloudflared-sync.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 
-# 📦 Install required tools (run via Woodpecker .woodpecker.yml)
+# 📦 Install required tools (for debugging / local run)
 apk add --no-cache git bash curl yq jq
 
 echo "🔍 Scanning for apps with cname.yaml..."
@@ -20,7 +20,7 @@ ORIGINAL_FILE="$INFRA_CLONE/manifests/cloudflared/values.yaml"
 MERGED_FILE="$INFRA_CLONE/manifests/cloudflared/values.yaml"
 
 # === STEP 1: Clone Repos ===
-echo "📦 Cloning sandbox-apps..."
+echo "📦 Cloning sandbox..."
 git clone --depth=1 "$SANDBOX_REPO_URL" "$SANDBOX_CLONE"
 
 echo "📦 Cloning infra..."
@@ -44,7 +44,7 @@ find "$SANDBOX_CLONE/manifests" -name cname.yaml | while read -r cname_file; do
 
     echo "✅ Found $hostname → $service"
 
-    # Append new entry to generated ingress list
+    # Append new entry
     yq eval ".ingress += [{\"hostname\": \"$hostname\", \"service\": \"$service\"}]" -i "$GENERATED_FILE"
   fi
 done
@@ -52,49 +52,28 @@ done
 echo "📄 Generated Ingress:"
 cat "$GENERATED_FILE"
 
-# === STEP 3: Merge with existing cloudflared values ===
+# === STEP 3: Merge only ingress into existing cloudflared values.yaml ===
 echo "🔁 Merging new entries into: $ORIGINAL_FILE"
 
-TEMP_FILE=$(mktemp)
-
-# Extract original ingress
-yq eval '.cloudflare.ingress' "$ORIGINAL_FILE" > "$TEMP_FILE"
-
-# Append new unique entries
-yq eval '.ingress' "$GENERATED_FILE" | yq eval -o=json '.' - | jq -c '.[]' | while read -r new_entry; do
-  hostname=$(echo "$new_entry" | jq -r '.hostname')
-  service=$(echo "$new_entry" | jq -r '.service')
-
-  exists=$(yq e ".cloudflare.ingress[] | select(.hostname == \"$hostname\")" "$ORIGINAL_FILE")
-
-  if [ -z "$exists" ]; then
-    echo "➕ Adding $hostname → $service"
-    yq eval ". += [{\"hostname\": \"$hostname\", \"service\": \"$service\"}]" -i "$TEMP_FILE"
-  else
-    echo "⚠️  $hostname already exists, skipping"
-  fi
-done
-
-# === STEP 4: Load preserved values ===
-TUNNEL_NAME=$(yq e '.cloudflare.tunnelName' "$ORIGINAL_FILE")
-ENABLE_WARP=$(yq e '.cloudflare.enableWarp' "$ORIGINAL_FILE")
-SECRET_NAME=$(yq e '.cloudflare.secretName' "$ORIGINAL_FILE")
-CLOUDFLARED_BLOCK=$(yq e '.cloudflared' "$ORIGINAL_FILE")
-
-# === STEP 5: Write final merged values ===
-echo "📝 Writing merged file to $MERGED_FILE"
-yq eval "
-.cloudflare.ingress = load(\"$TEMP_FILE\") |
-.cloudflare.tunnelName = \"$TUNNEL_NAME\" |
-.cloudflare.enableWarp = \"$ENABLE_WARP\" |
-.cloudflare.secretName = \"$SECRET_NAME\" |
-.cloudflared = $CLOUDFLARED_BLOCK
-" "$ORIGINAL_FILE" > "$MERGED_FILE"
+yq eval-all '
+  # File 0 = Original cloudflared values
+  # File 1 = Generated ingress block
+  (select(fileIndex == 0) as $orig | select(fileIndex == 1) as $new |
+    $orig * {
+      cloudflare: $orig.cloudflare * {
+        ingress: (
+          ($orig.cloudflare.ingress + $new.ingress)
+          | unique_by(.hostname)
+        )
+      }
+    }
+  )
+' "$ORIGINAL_FILE" "$GENERATED_FILE" > "$MERGED_FILE"
 
 echo "✅ Final merged values.yaml:"
 cat "$MERGED_FILE"
 
-# === STEP 6: Optional Git push ===
+# === STEP 4: Commit & Push ===
 echo "📤 Pushing updated values.yaml to infra repo..."
 
 cd "$INFRA_CLONE"
@@ -109,4 +88,4 @@ if ! git diff --quiet manifests/cloudflared/values.yaml; then
   echo "✅ Changes pushed successfully."
 else
   echo "ℹ️  No changes to commit."
-fi
\ No newline at end of file
+fi