diff --git a/README.md b/README.md
index 12d1373..822e2a0 100644
--- a/README.md
+++ b/README.md
@@ -45,23 +45,29 @@ helm version
 
 ---
 
-## Phase 2 — Set credentials
+## Phase 2 — Set ArgoCD admin password
 
-```bash
-cp .env.example .env
-```
-
-Generate a bcrypt hash of your password and paste it into `.env`:
+Install `httpd-tools` (one-time):
 
 ```bash
 sudo dnf install -y httpd-tools
 ```
 
+Generate bcrypt hash and paste it into `manifests/argocd/values.yaml` under `configs.secret.argocdServerAdminPassword`:
+
 ```bash
 htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
 ```
 
-Set `ARGOCD_ADMIN_PASSWORD_HASH` in `.env` to the output. This file is gitignored — never commit it.
+Commit the updated values:
+
+```bash
+git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
+```
+
+```bash
+git push origin main
+```
 
 ---
 
@@ -80,11 +86,7 @@ helm repo update
 Install ArgoCD:
 
 ```bash
-source .env
-```
-
-```bash
-helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml --set configs.secret.argocdServerAdminPassword="$ARGOCD_ADMIN_PASSWORD_HASH" --set configs.secret.argocdServerAdminPasswordMtime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
 ```
 
 Wait for ArgoCD to be ready:
diff --git a/manifests/argocd/values.yaml b/manifests/argocd/values.yaml
index b9ab66f..4653e59 100644
--- a/manifests/argocd/values.yaml
+++ b/manifests/argocd/values.yaml
@@ -18,6 +18,16 @@ global:
 configs:
   params:
     server.insecure: true   # TLS terminated at Envoy Gateway
+  secret:
+    # Generate: htpasswd -nbBC 10 "" PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
+    argocdServerAdminPassword: ""
+    argocdServerAdminPasswordMtime: "2025-01-01T00:00:00Z"
 
 server:
   replicas: 1
+  httproute:
+    enabled: true
+    parentRefs:
+      - name: envoy-gateway
+        namespace: gateway-system
+        sectionName: http