diff --git a/README.md b/README.md
index 5fcccd7..10fc039 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,9 @@ See [docs/chart-ownership.md](docs/chart-ownership.md) for the complete chart ve
 ## Layout
 
 - `bootstrap/` contains AppProjects and Applications.
+- `root-application.yaml` is the app-of-apps entry point that continuously
+  reconciles `bootstrap/`; this is what makes CI commits to Application
+  `targetRevision` fields take effect without kubectl.
 - `apps/<name>/values.yaml` contains only this cluster's values for that chart.
 - `apps/<name>/resources/` is allowed only for genuinely cluster-owned resources, such as a MetalLB address pool or
   an ImmichFrame `SealedSecret`.
diff --git a/bootstrap/install-argocd.sh b/bootstrap/install-argocd.sh
index 4d30f81..338a1f7 100755
--- a/bootstrap/install-argocd.sh
+++ b/bootstrap/install-argocd.sh
@@ -10,9 +10,9 @@ fi
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repository_dir=$(dirname -- "${script_dir}")
-app_dir="${repository_dir}/apps/argocd"
+values_file="${repository_dir}/apps/argocd/values.yaml"
 
-for command in helm kubectl openssl base64 ruby; do
+for command in helm kubectl openssl base64; do
   if ! command -v "${command}" >/dev/null 2>&1; then
     echo "Required command not found: ${command}" >&2
     exit 1
@@ -54,21 +54,10 @@ if ! kubectl --namespace argocd get secret argocd-oidc >/dev/null 2>&1; then
   exit 1
 fi
 
-helm dependency update "${app_dir}"
-set -- "${app_dir}"/charts/argo-cd-*.tgz
-if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then
-  echo "Expected exactly one downloaded argo-cd chart archive" >&2
-  exit 1
-fi
-chart_archive=$1
-
-child_values=$(mktemp)
-trap 'rm -f "${child_values}"' EXIT HUP INT TERM
-ruby -ryaml -e 'puts YAML.dump(YAML.load_file(ARGV.fetch(0)).fetch("argo-cd"))' \
-  "${app_dir}/values.yaml" > "${child_values}"
-
-helm upgrade --install argocd "${chart_archive}" \
+helm upgrade --install argocd argo-cd \
+  --repo https://argoproj.github.io/argo-helm \
+  --version 10.10.5 \
   --namespace argocd \
-  --values "${child_values}" \
+  --values "${values_file}" \
   --wait \
   --timeout 10m
diff --git a/bootstrap/install.sh b/bootstrap/install.sh
index b83be6b..3fbcc37 100755
--- a/bootstrap/install.sh
+++ b/bootstrap/install.sh
@@ -9,8 +9,16 @@ if [ "${current_context}" != "${expected_context}" ]; then
 fi
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-kubectl apply --dry-run=server -k "${script_dir}"
-kubectl apply -k "${script_dir}"
+repository_dir=$(dirname -- "${script_dir}")
+root_application="${repository_dir}/root-application.yaml"
+kubectl apply --dry-run=server --filename "${root_application}"
+kubectl apply --filename "${root_application}"
+kubectl --namespace argocd wait application/homelab-bootstrap \
+  --for=jsonpath='{.status.sync.status}'=Synced \
+  --timeout=5m
+kubectl --namespace argocd wait application/homelab-bootstrap \
+  --for=jsonpath='{.status.health.status}'=Healthy \
+  --timeout=5m
 kubectl --namespace argocd wait application/immich-sync \
   --for=jsonpath='{.status.sync.status}'=Synced \
   --timeout=5m
@@ -56,7 +64,19 @@ do
     --timeout=5m
 done
 for application in \
-  artcraft \
+  cadcraft \
+  deckcraft \
+  designcraft \
+  effectcraft \
+  figcraft \
+  filmcraft \
+  gridcraft \
+  lightcraft \
+  pdfcraft \
+  photocraft \
+  soundcraft \
+  vectorcraft \
+  wordcraft \
   brunner-ninja \
   coturn \
   flaresolverr \
diff --git a/root-application.yaml b/root-application.yaml
new file mode 100644
index 0000000..9edd911
--- /dev/null
+++ b/root-application.yaml
@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: homelab-bootstrap
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: bootstrap
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: true
+      selfHeal: true