diff --git a/oci/charts/README.md b/oci/charts/README.md
index 5665ca7..25c7c46 100644
--- a/oci/charts/README.md
+++ b/oci/charts/README.md
@@ -5,7 +5,7 @@ This repository stores reusable Helm charts published to `ghcr.io/x-evor`.
 ## Layout
 
 - `apps/app-service`: reusable runtime chart for application services
-- `infra/platform/k3s`: platform composition chart for `caddy`, `apisix`, and `vault`
+- `infra/platform/k3s`: platform composition chart for `caddy`, `apisix`, `external-dns`, `external-secrets`, and `vault`
 - `postgresql`: PostgreSQL service chart with optional `stunnel` server/client
 - `observability`: observability composition chart for server and agent components
 
diff --git a/oci/charts/infra/platform/k3s/Chart.yaml b/oci/charts/infra/platform/k3s/Chart.yaml
index a96f5af..f282f86 100644
--- a/oci/charts/infra/platform/k3s/Chart.yaml
+++ b/oci/charts/infra/platform/k3s/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: k3s-platform-chart
 description: Composes Flux-managed platform components for the k3s platform
 type: application
-version: 0.1.3
+version: 0.1.4
 appVersion: "1.0.0"
diff --git a/oci/charts/infra/platform/k3s/templates/clustersecretstore.yaml b/oci/charts/infra/platform/k3s/templates/clustersecretstore.yaml
new file mode 100644
index 0000000..7609401
--- /dev/null
+++ b/oci/charts/infra/platform/k3s/templates/clustersecretstore.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.components.externalSecretsStore.enabled }}
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: {{ .Values.components.externalSecretsStore.name }}
+spec:
+  provider:
+    vault:
+      server: {{ .Values.components.externalSecretsStore.vault.server }}
+      path: {{ .Values.components.externalSecretsStore.vault.path }}
+      version: {{ .Values.components.externalSecretsStore.vault.version }}
+      auth:
+        kubernetes:
+          mountPath: {{ .Values.components.externalSecretsStore.vault.auth.kubernetes.mountPath }}
+          role: {{ .Values.components.externalSecretsStore.vault.auth.kubernetes.role }}
+          serviceAccountRef:
+            name: {{ .Values.components.externalSecretsStore.vault.auth.kubernetes.serviceAccountRef.name }}
+            namespace: {{ .Values.components.externalSecretsStore.vault.auth.kubernetes.serviceAccountRef.namespace }}
+{{- end }}
diff --git a/oci/charts/infra/platform/k3s/templates/external-dns.yaml b/oci/charts/infra/platform/k3s/templates/external-dns.yaml
new file mode 100644
index 0000000..b8eb745
--- /dev/null
+++ b/oci/charts/infra/platform/k3s/templates/external-dns.yaml
@@ -0,0 +1,46 @@
+{{- if .Values.components.externalDns.enabled }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: {{ .Values.components.externalDns.secret.name }}
+  namespace: {{ .Values.namespaces.platform }}
+spec:
+  refreshInterval: {{ .Values.components.externalDns.secret.refreshInterval }}
+  secretStoreRef:
+    kind: {{ .Values.components.externalDns.secret.secretStoreRef.kind }}
+    name: {{ .Values.components.externalDns.secret.secretStoreRef.name }}
+  target:
+    name: {{ .Values.components.externalDns.secret.target.name }}
+    creationPolicy: {{ .Values.components.externalDns.secret.target.creationPolicy }}
+  data:
+    - secretKey: {{ .Values.components.externalDns.secret.data.secretKey }}
+      remoteRef:
+        key: {{ .Values.components.externalDns.secret.data.remoteRef.key }}
+        property: {{ .Values.components.externalDns.secret.data.remoteRef.property }}
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: {{ .Values.components.externalDns.releaseName }}
+  namespace: {{ .Values.namespaces.platform }}
+spec:
+  interval: 10m0s
+  releaseName: {{ .Values.components.externalDns.releaseName }}
+  chart:
+    spec:
+      chart: {{ .Values.components.externalDns.chart.name }}
+      version: {{ .Values.components.externalDns.chart.version | quote }}
+      sourceRef:
+        kind: {{ .Values.components.externalDns.sourceRef.kind }}
+        name: {{ .Values.components.externalDns.sourceRef.name }}
+        namespace: {{ .Values.components.externalDns.sourceRef.namespace }}
+  install:
+    createNamespace: false
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    {{- toYaml .Values.components.externalDns.values | nindent 4 }}
+{{- end }}
diff --git a/oci/charts/infra/platform/k3s/values.yaml b/oci/charts/infra/platform/k3s/values.yaml
index 4d90d96..f167b3e 100644
--- a/oci/charts/infra/platform/k3s/values.yaml
+++ b/oci/charts/infra/platform/k3s/values.yaml
@@ -73,6 +73,59 @@ components:
                     type: roundrobin
                     nodes:
                       "accounts.core-pre.svc.cluster.local:80": 1
+  externalDns:
+    enabled: true
+    releaseName: external-dns
+    sourceRef:
+      kind: HelmRepository
+      name: external-dns
+      namespace: flux-system
+    chart:
+      name: external-dns
+      version: ">=1.14.0 <2.0.0"
+    secret:
+      name: cloudflare-api-token
+      refreshInterval: 1m
+      secretStoreRef:
+        kind: ClusterSecretStore
+        name: vault-platform
+      target:
+        name: cloudflare-api-token
+        creationPolicy: Owner
+      data:
+        secretKey: api-token
+        remoteRef:
+          key: platform/cloudflare
+          property: api-token
+    values:
+      provider: cloudflare
+      policy: sync
+      registry: txt
+      txtOwnerId: svc-plus-k3s
+      sources:
+        - ingress
+      domainFilters:
+        - svc.plus
+      env:
+        - name: CF_API_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: cloudflare-api-token
+              key: api-token
+  externalSecretsStore:
+    enabled: true
+    name: vault-platform
+    vault:
+      server: http://vault.extsvc.svc.cluster.local:8200
+      path: secret
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets
+          serviceAccountRef:
+            name: external-secrets
+            namespace: platform
   vault:
     enabled: true
     releaseName: vault