diff --git a/automation/cloudflared-sync.sh b/automation/cloudflared-sync.sh
index 41f91e9..981754b 100644
--- a/automation/cloudflared-sync.sh
+++ b/automation/cloudflared-sync.sh
@@ -1,52 +1,41 @@
-#!/bin/bash
-set -e
+# CONFIG
+ORIGINAL_FILE="../infra/cloudflared/values.yaml"
+MERGED_FILE="../infra/cloudflared/values.yaml"
+GENERATED_FILE="generated-values/cloudflared-values.yaml"
 
-echo "🔍 Scanning for apps with cname.yaml..."
+echo "🔁 Merging new entries into: $ORIGINAL_FILE"
 
-mkdir -p generated-values
+# Extract original ingress list
+ORIGINAL_INGRESS=$(yq eval '.cloudflare.ingress' "$ORIGINAL_FILE")
+TEMP_FILE=$(mktemp)
 
-# Initial empty cloudflared config
-cat <<EOF > generated-values/cloudflared-values.yaml
-ingress:
-  - service: http_status:404
-EOF
+# Start a fresh ingress list
+echo "$ORIGINAL_INGRESS" | yq eval '.' - > "$TEMP_FILE"
 
-# === CONFIGURATION ===
-REPOS=(
-  "https://git.dvirlabs.com/dvirlabs/sandbox.git"
-)
-WORKDIR=".tmp-repos"
+# Loop over new entries
+yq eval '.ingress[]' "$GENERATED_FILE" | yq eval -o=json '.' - | jq -c '.[]' | while read -r new_entry; do
+  hostname=$(echo "$new_entry" | jq -r '.hostname')
+  service=$(echo "$new_entry" | jq -r '.service')
 
-rm -rf $WORKDIR
-mkdir -p $WORKDIR
+  # Check if hostname already exists
+  exists=$(yq e ".cloudflare.ingress[] | select(.hostname == \"$hostname\")" "$ORIGINAL_FILE")
 
-# === CLONE AND SCAN ===
-for repo_url in "${REPOS[@]}"; do
-  repo_name=$(basename "$repo_url" .git)
-  echo "📦 Cloning $repo_name..."
-
-  git clone --depth=1 "$repo_url" "$WORKDIR/$repo_name"
-
-  find "$WORKDIR/$repo_name/manifests" -name cname.yaml | while read -r cname_file; do
-    app_name=$(basename $(dirname "$cname_file"))
-    enabled=$(yq '.enabled' "$cname_file")
-
-    if [[ "$enabled" == "true" ]]; then
-      hostname=$(yq '.hostname' "$cname_file")
-      service="http://${app_name}.my-apps.svc.cluster.local:80"
-
-      echo "✅ Found $hostname → $service"
-
-      # Add to generated-values
-      yq eval ".ingress = [{\"hostname\": \"$hostname\", \"service\": \"$service\"}] + .ingress" \
-        -i generated-values/cloudflared-values.yaml
-    fi
-  done
+  if [ -z "$exists" ]; then
+    echo "➕ Adding $hostname → $service"
+    # Append new entry
+    yq eval ". += [{\"hostname\": \"$hostname\", \"service\": \"$service\"}]" -i "$TEMP_FILE"
+  else
+    echo "⚠️  $hostname already exists, skipping"
+  fi
 done
 
-echo "✅ Done! See: generated-values/cloudflared-values.yaml"
+# Rebuild final values.yaml with updated ingress
+yq eval '
+  .cloudflare.ingress = load("'"$TEMP_FILE"'") |
+  .cloudflare.tunnelName = strenv(TUNNEL_NAME) |
+  .cloudflare.enableWarp = false |
+  .cloudflare.secretName = "cloudflared-creds" |
+  .cloudflared = load("'"$ORIGINAL_FILE"'") | .cloudflared
+' "$ORIGINAL_FILE" > "$MERGED_FILE"
 
-echo
-echo "📄 ==== cloudflared-values.yaml ==== "
-cat generated-values/cloudflared-values.yaml
-echo "===================================="
+echo "✅ Patched values.yaml saved to: $MERGED_FILE"