diff --git a/README.md b/README.md
index ffc40b2..d061920 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ Bootstrap order (sync waves):
   Wave 1 → metallb-config   (IPAddressPool + L2Advertisement)
   Wave 2 → envoy-gateway    (HTTP gateway controller)
   Wave 2 → nfs-provisioner  (dynamic PVC provisioner from xpen NAS)
+  Wave 2 → metrics-server   (Metrics API for `kubectl top` / HPA, kube-system)
   Wave 3 → envoy-gateway-config (GatewayClass + EnvoyProxy + Gateway)
 
 External access:
diff --git a/bootstrap/apps/metrics-server.yaml b/bootstrap/apps/metrics-server.yaml
new file mode 100644
index 0000000..cbe4952
--- /dev/null
+++ b/bootstrap/apps/metrics-server.yaml
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    - repoURL: https://kubernetes-sigs.github.io/metrics-server/
+      chart: metrics-server
+      targetRevision: "3.12.2"  # TODO: verify latest via `helm search repo metrics-server/metrics-server --versions`
+      helm:
+        valueFiles:
+          - $values/manifests/metrics-server/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
diff --git a/manifests/metrics-server/values.yaml b/manifests/metrics-server/values.yaml
new file mode 100644
index 0000000..33222cc
--- /dev/null
+++ b/manifests/metrics-server/values.yaml
@@ -0,0 +1,12 @@
+# Serves the Metrics API (metrics.k8s.io) behind `kubectl top` and HPA.
+# Not the same as kube-state-metrics (kube-prometheus-stack) — that one only
+# exports object state to Prometheus, it doesn't register the Metrics API.
+args:
+  # Kubelets were bootstrapped by kubeadm without serverTLSBootstrap, so
+  # their serving certs are self-signed (not issued by the cluster CA) —
+  # metrics-server can't verify them. Drop this flag only after enabling
+  # serverTLSBootstrap on every kubelet + approving the serving CSRs.
+  - --kubelet-insecure-tls
+  # Nodes have no DNS-resolvable hostnames from inside the cluster; scrape
+  # kubelets by InternalIP (192.168.1.3x) instead.
+  - --kubelet-preferred-address-types=InternalIP