diff --git a/apps/coredns/README.md b/apps/coredns/README.md
new file mode 100644
index 0000000..37cf3fc
--- /dev/null
+++ b/apps/coredns/README.md
@@ -0,0 +1,18 @@
+# CoreDNS adoption
+
+The upstream CoreDNS chart is staged as an Argo Application with automatic sync
+disabled. It preserves the `kube-system/coredns` Deployment selector, the
+`kube-dns` Service name and `10.96.0.10` ClusterIP, the current image tag,
+Corefile behavior, two ODROID replicas, and the existing PDB selector.
+
+Do not enable automatic sync before reviewing the live Argo diff and proving
+DNS resolution through the two existing endpoints. The chart uses different
+port names and additional Pod labels/security settings, so adoption will roll
+cluster DNS even though its serving port numbers remain 53/TCP and 53/UDP.
+The existing `system:coredns` RBAC and `coredns` ServiceAccount remain owned by
+Kubernetes bootstrap; this chart intentionally does not render replacements.
+
+Until cutover succeeds, the historical `coredns-deployment` repository remains
+the live direct-CD writer. Once Argo is Synced/Healthy and DNS tests pass,
+retire that workflow and its kubeconfig/RBAC and archive the deployment-only
+repository.
diff --git a/apps/coredns/values.yaml b/apps/coredns/values.yaml
new file mode 100644
index 0000000..c9fd0fe
--- /dev/null
+++ b/apps/coredns/values.yaml
@@ -0,0 +1,89 @@
+replicaCount: 2
+k8sAppLabelOverride: kube-dns
+deployment:
+  name: coredns
+  selector:
+    matchLabels:
+      k8s-app: kube-dns
+service:
+  name: kube-dns
+  clusterIP: 10.96.0.10
+  selector:
+    k8s-app: kube-dns
+serviceAccount:
+  create: false
+  name: coredns
+rbac:
+  create: false
+image:
+  repository: registry.k8s.io/coredns/coredns
+  tag: v1.14.7
+priorityClassName: system-cluster-critical
+nodeSelector:
+  kubernetes.io/os: linux
+tolerations:
+- key: CriticalAddonsOnly
+  operator: Exists
+- key: node-role.kubernetes.io/control-plane
+  effect: NoSchedule
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: odroid-h3
+          operator: In
+          values:
+          - enabled
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+    - labelSelector:
+        matchLabels:
+          k8s-app: kube-dns
+      topologyKey: kubernetes.io/hostname
+podDisruptionBudget:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      k8s-app: kube-dns
+resources:
+  limits:
+    cpu: null
+    memory: 170Mi
+  requests:
+    cpu: 100m
+    memory: 70Mi
+readinessProbe:
+  initialDelaySeconds: 0
+  periodSeconds: 10
+servers:
+- zones:
+  - zone: .
+    use_tcp: true
+  port: 53
+  plugins:
+  - name: errors
+  - name: health
+    configBlock: |-
+      lameduck 5s
+  - name: ready
+  - name: kubernetes
+    parameters: cluster.local in-addr.arpa ip6.arpa
+    configBlock: |-
+      pods insecure
+      fallthrough in-addr.arpa ip6.arpa
+      ttl 30
+  - name: prometheus
+    parameters: :9153
+  - name: forward
+    parameters: . /etc/resolv.conf
+    configBlock: |-
+      max_concurrent 1000
+  - name: cache
+    parameters: 30
+    configBlock: |-
+      disable success cluster.local
+      disable denial cluster.local
+  - name: loop
+  - name: reload
+  - name: loadbalance
diff --git a/bootstrap/coredns-project.yaml b/bootstrap/coredns-project.yaml
new file mode 100644
index 0000000..010a66a
--- /dev/null
+++ b/bootstrap/coredns-project.yaml
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: coredns
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  description: Kubernetes cluster DNS
+  sourceRepos:
+  - https://coredns.github.io/helm
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - namespace: kube-system
+    server: https://kubernetes.default.svc
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: Service
+  - group: apps
+    kind: Deployment
+  - group: policy
+    kind: PodDisruptionBudget
diff --git a/bootstrap/coredns.yaml b/bootstrap/coredns.yaml
new file mode 100644
index 0000000..8a80915
--- /dev/null
+++ b/bootstrap/coredns.yaml
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: coredns
+  namespace: argocd
+spec:
+  project: coredns
+  sources:
+  - repoURL: https://coredns.github.io/helm
+    chart: coredns
+    targetRevision: 1.49.0
+    helm:
+      releaseName: coredns
+      valueFiles:
+      - $values/apps/coredns/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      enabled: false
+      prune: false
+      selfHeal: false
+    syncOptions:
+    - CreateNamespace=false
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index f85ea6e..3ccda47 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -79,3 +79,5 @@ resources:
 - elastic-project.yaml
 - elastic-operator.yaml
 - elastic.yaml
+- coredns-project.yaml
+- coredns.yaml