diff --git a/workloads/demo-app/front.yaml b/workloads/demo-app/front.yaml
index d475a37..9d75b92 100644
--- a/workloads/demo-app/front.yaml
+++ b/workloads/demo-app/front.yaml
@@ -22,7 +22,7 @@ data:
     <!doctype html><html lang="ja"><meta charset="utf-8"><title>selfheal demo</title>
     <body style="font-family:system-ui;margin:2rem"><h1>selfheal demo front</h1>
     <p>container layer (AWS k8s) -&gt; VPN -&gt; VM layer (GCP legacy-api, PostgreSQL)</p>
-    <ul><li><a href="/api/orders">/api/orders</a></li><li><a href="/api/price/apple">/api/price/apple</a></li><li><a href="/api/readyz">/api/readyz</a></li></ul>
+    <ul><li><a href="/api/orders">/api/orders</a></li><li><a href="/api/price/apple">/api/price/apple</a></li><li><a href="/api/price/nothere">/api/price/nothere (404)</a></li></ul>
     </body></html>
 ---
 apiVersion: apps/v1
diff --git a/workloads/ingress-nginx/kustomization.yaml b/workloads/ingress-nginx/kustomization.yaml
index a4ef331..984c15d 100644
--- a/workloads/ingress-nginx/kustomization.yaml
+++ b/workloads/ingress-nginx/kustomization.yaml
@@ -16,3 +16,15 @@ patches:
       - op: add
         path: /spec/ports/1/nodePort
         value: 30443
+  # The admission Jobs have ttlSecondsAfterFinished: 0 and vanish after they complete, which Argo CD would report as
+  # OutOfSync forever (and re-run on every selfHeal). Run them as Sync hooks instead and let Argo CD delete them.
+  - target:
+      kind: Job
+      name: ingress-nginx-admission-.*
+      namespace: ingress-nginx
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/hook: Sync
+          argocd.argoproj.io/hook-delete-policy: HookSucceeded