diff --git a/apps/pangolin/pangolin-controller-api-key-sealed.yaml b/apps/pangolin/pangolin-controller-api-key-sealed.yaml
index 4fcdd6a..16b7bd3 100644
--- a/apps/pangolin/pangolin-controller-api-key-sealed.yaml
+++ b/apps/pangolin/pangolin-controller-api-key-sealed.yaml
@@ -7,7 +7,7 @@ metadata:
   namespace: pangolin
 spec:
   encryptedData:
-    auth-header: AgBl52zzaXPKKU8RGWux+Rtlk1Z6jQX53psMs1Ypody6iQjgc3yc4Qg4yhLQPaa327JlpbUaXl0oDr+0lN7OPczgtLgWImcC8hDdr2aZ108636jk762fJBJc+iuh2uHPf9Jmu8/5Hie1Y7T5O4GKkjByJNWIO83Seeo64lYpXfggIeTWp/JdpiBWZFOHfJGt41TJlOptw6+CLVtF9GanEBb38LQq0UdTx15Nfc+FmFEcxy8xQZewWlk7V6NaY8Eck/hrhzLWGkdcnItbJNGIB2VqUSW56GcCEDRxkDYRJ/rNQ1brJyCRLCGwPp8jlQpQ0o4ecPhRk55lawtSFz2kNSyRbOdJwCskR101eIhoBAjgfRXEd0ek2+9TIDApobj0TsXd1P/r2xoWRmfmTikEtZmBlbZT5JaS2DnNyWFWyLMBJdbcofsTYorudzPg5WfJfCYXhbOAB8Di9bIhxGEUTcRg2FRNdo1msQ8T5hRH7vHFDLAxovAdm/NZeNv+1q/2+h1Vi/bOGtZoDMuM7aMM6kmishd6jUDElIVpR9lIIRif6dMVfCOHjL0wEPqH60bylE0kKn9pi9ERXANpODVBP+pPHstI67S1+mKvg2/3jSc8n+9DYAmJitYUUw0DDUM6EAuRGOI9FgybzOP2gIPZ2qeWSGx6IWLDNcXqF+w4xyEGR3/iEeKDOoW3dFxlgnUVbZ2QzPQ+OXGpEkXJ8IYQVPV0XZWMj/5/ZPEKo3nUZF7m/PbDyrZjwFLKL5AN4WJ7pBhS0n3uxvYyR6Zh7h6LVJE=
+    auth-header: AgAqHAbAjJG5d8mY1sNkVamnWsl/xdxjthiUWaEd7mXMMHAF9hr+Opy6cIH5BerrU9wtS73YA7be3Xjz8cGFy8LdQvldIBVYzOsA/VTlwMKDoet8bO5eoGEH91Gz7haBBWJvezmeNNxkH7bGlHPvly7+JY8whx9XJWY/hKb6uH2j4fnbSkkL68WobsxbZeJikvLFQrQIxlH0nRc2se4bM+LWJKukiSlWx00qeTGsROvVhxK5tgRMYO4xwPaiEktY9ORHPUYqAmVgdu85d0ygv94XiIFoPSChluVKI9AociynKVb4dQiBbHpKQSsUFBD7US1o1wmgFY8LZCvU9FdbB37VAG5Bxt0VDvOws650NGXLS8CbzidjaBtlpFiJYZRviF2GevIj8UqcmtYFGuvmDMGsGtXOmpkSMiZQyco4lLSWGCwyOYAwEaMNbzzgPbq7VfKJ9efm/rxK7X2t15FCl4jHpI/TC/LobDEBxvK4eELynS5HtcxmwTafYRlp0l1cfTI2yN4ZrsBVsgbCDTZXDjcMuabC6qEjbNrk158KbotkdKFS9mv7Hr3JyrM7PfDQvPtFHUpAzcPESIsElewcwrxGOyLyzYqRPo7wGj9lt4xkQB7OYzlzIP/IxAqzQkiJFv7VU8qCrMVd3VYLn9pbQ71Hv9g+CfuanO1er51Z5s3l9XMA2Zpnoy2uimPkA8svWuIKYcevSH1Gv92zj41jWTy712B9S6w8V7O19Qz6YPBwsezA0EfouDclO0f3Kt4wb0T0QJHHgTBoSjLmC/mFNmQ=
   template:
     metadata:
       creationTimestamp: null
diff --git a/apps/pangolin/pangolin-controller-config.yaml b/apps/pangolin/pangolin-controller-config.yaml
index 4304194..10bdd87 100644
--- a/apps/pangolin/pangolin-controller-config.yaml
+++ b/apps/pangolin/pangolin-controller-config.yaml
@@ -4,7 +4,10 @@ metadata:
   name: pangolin-controller-config
   namespace: pangolin
 data:
-  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config"
+  # The Traefik dynamic config endpoint lives on Pangolin's internal API port (3001),
+  # not the external dashboard API (3000). The external port serves the session-authenticated
+  # dashboard router which returns 401 for Bearer requests to /api/v1/traefik-config.
+  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config"
   CONFIG_ALLOW_INSECURE_HTTP: "true"
   TARGET_NAMESPACE: "pangolin"
   ENABLE_LEADER_ELECTION: "true"
diff --git a/apps/pangolin/pangolin-controller-deployment.yaml b/apps/pangolin/pangolin-controller-deployment.yaml
index 4aa6756..7aa8683 100644
--- a/apps/pangolin/pangolin-controller-deployment.yaml
+++ b/apps/pangolin/pangolin-controller-deployment.yaml
@@ -7,12 +7,7 @@ metadata:
     app: pangolin-controller
     component: controller
 spec:
-  # Scaled to 0 after Pangolin DB migration (SQLite -> PostgreSQL, DEV-451):
-  # the fresh Pangolin has no admin user or API key yet, so the controller's
-  # bearer token in pangolin-controller-api-key SealedSecret is invalid.
-  # Re-enable after running Pangolin initial setup and resealing a new key.
-  # Tracked in the follow-up child issue.
-  replicas: 0
+  replicas: 1
   strategy:
     type: Recreate
   selector:
diff --git a/apps/pangolin/pangolin-deployment.yaml b/apps/pangolin/pangolin-deployment.yaml
index 2e51616..616745b 100644
--- a/apps/pangolin/pangolin-deployment.yaml
+++ b/apps/pangolin/pangolin-deployment.yaml
@@ -175,6 +175,12 @@ spec:
     port: 3000
     targetPort: 3000
     protocol: TCP
+  # Internal API (used by pangolin-kube-controller for /api/v1/traefik-config).
+  # This port has no auth by design — never route it through the public Ingress.
+  - name: internal
+    port: 3001
+    targetPort: 3001
+    protocol: TCP
   - name: http
     port: 3002
     targetPort: 3002