diff --git a/clusters/base/apps/davical/helmrelease-davical.yaml b/clusters/base/apps/davical/helmrelease-davical.yaml
index 1146429..70118b7 100644
--- a/clusters/base/apps/davical/helmrelease-davical.yaml
+++ b/clusters/base/apps/davical/helmrelease-davical.yaml
@@ -82,7 +82,7 @@ spec:
     ingress:
       app:
         className: traefik
-        # no cert-manager annotation here: radicale's own Ingress already
+        # no cert-manager annotation here: infcloud's own Ingress already
         # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
         # A second Ingress with the annotation would create a competing
         # Certificate for the same host/secret.
@@ -90,11 +90,6 @@ spec:
         # No stripPrefix middleware either: Apache needs to see the /server
         # prefix itself (via the Alias added in the seed-config initContainer)
         # so that DAViCal's self-referential links come out correct.
-        #
-        # c2.aggtaa.com/server is the same backend, reachable same-origin
-        # from InfCloud (also on c2.aggtaa.com) so its browser-side CalDAV
-        # requests don't need CORS. That ingress owns the cert-manager
-        # annotation for c2.aggtaa.com; this one just reuses its secret.
         hosts:
           - host: c.aggtaa.com
             paths:
@@ -103,20 +98,10 @@ spec:
                 service:
                   identifier: app
                   port: http
-          - host: c2.aggtaa.com
-            paths:
-              - path: /server
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
         tls:
           - secretName: radicale-tls
             hosts:
               - c.aggtaa.com
-          - secretName: infcloud-tls
-            hosts:
-              - c2.aggtaa.com
 
     persistence:
       config:
diff --git a/clusters/base/apps/infcloud/helmrelease-infcloud.yaml b/clusters/base/apps/infcloud/helmrelease-infcloud.yaml
index 00573b1..f0f2ed6 100644
--- a/clusters/base/apps/infcloud/helmrelease-infcloud.yaml
+++ b/clusters/base/apps/infcloud/helmrelease-infcloud.yaml
@@ -34,13 +34,16 @@ spec:
     ingress:
       app:
         className: traefik
-        # this ingress owns the cert-manager request for c2.aggtaa.com;
-        # davical's ingress adds a second host on the same domain (for the
-        # /server CalDAV path) and just references the secret below.
+        # this ingress owns the cert-manager request for c.aggtaa.com
+        # (secret kept as "radicale-tls" post-migration so the existing,
+        # already-valid cert is reused instead of re-issued). davical's
+        # ingress just references the same secret without its own
+        # annotation - a second annotated Ingress would create a
+        # competing Certificate for the same host/secret.
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-prod
         hosts:
-          - host: c2.aggtaa.com
+          - host: c.aggtaa.com
             paths:
               - path: /
                 pathType: Prefix
@@ -48,9 +51,9 @@ spec:
                   identifier: app
                   port: http
         tls:
-          - secretName: infcloud-tls
+          - secretName: radicale-tls
             hosts:
-              - c2.aggtaa.com
+              - c.aggtaa.com
 
     persistence:
       config:
diff --git a/clusters/base/apps/radicale/configmap.yaml b/clusters/base/apps/radicale/configmap.yaml
deleted file mode 100644
index 28240a6..0000000
--- a/clusters/base/apps/radicale/configmap.yaml
+++ /dev/null
@@ -1,44 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radicale-config
-  namespace: pim
-data:
-  # storage.hook (the git-commit-per-change hook in the old compose setup)
-  # called out to a webhooks sidecar that isn't part of this deployment yet,
-  # so it's dropped here rather than pointing at a script that doesn't exist.
-  config: |
-    [server]
-    hosts = 0.0.0.0:5232
-    ssl = False
-
-    [auth]
-    type = htpasswd
-    htpasswd_filename = /config/users
-    htpasswd_encryption = bcrypt
-
-    [rights]
-    type = owner_only
-    # file = /config/rights
-
-    [storage]
-    type = multifilesystem
-    filesystem_folder = /data/collections
-
-    [headers]
-    Access-Control-Allow-Origin = *
-    Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
-    Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
-    Access-Control-Expose-Headers: Etag, Preference-Applied
-  rights: |
-    # read access to root collection for all users
-    [all-read-root-collection]
-    user = .+
-    collection =
-    permission = r
-
-    # write access to own files for each user
-    [owner-write]
-    user: .+
-    collection: ^%(login)s(/.+)?$
-    permission: rw
diff --git a/clusters/base/apps/radicale/helmrelease-agendav.yaml b/clusters/base/apps/radicale/helmrelease-agendav.yaml
deleted file mode 100644
index f8c6159..0000000
--- a/clusters/base/apps/radicale/helmrelease-agendav.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: agendav
-  namespace: pim
-spec:
-  interval: 10m
-  chartRef:
-    kind: OCIRepository
-    name: radicale
-  driftDetection:
-    mode: enabled
-  values:
-    controllers:
-      agendav:
-        containers:
-          app:
-            image:
-              repository: ghcr.io/nagimov/agendav-docker
-              tag: latest
-            env:
-              AGENDAV_SERVER_NAME: "127.0.0.1"
-              AGENDAV_TITLE: ""
-              AGENDAV_FOOTER: ""
-              AGENDAV_CALDAV_SERVER: "http://davical.pim.svc.cluster.local/caldav.php"
-              AGENDAV_CALDAV_PUBLIC_URL: "https://c.aggtaa.com/server/caldav.php"
-              AGENDAV_TIMEZONE: "Europe/Moscow"
-              AGENDAV_WEEKSTART: "1"
-              AGENDAV_LANG: "en"
-              AGENDAV_LOG_DIR: "/tmp/"
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-
-    service:
-      app:
-        controller: agendav
-        ports:
-          http:
-            port: 8080
-
-    ingress:
-      app:
-        className: traefik
-        # no cert-manager annotation here: radicale's own Ingress already
-        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
-        # A second Ingress with the annotation would create a competing
-        # Certificate for the same host/secret.
-        hosts:
-          - host: c.aggtaa.com
-            paths:
-              - path: /
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - secretName: radicale-tls
-            hosts:
-              - c.aggtaa.com
diff --git a/clusters/base/apps/radicale/helmrelease-radicale.yaml b/clusters/base/apps/radicale/helmrelease-radicale.yaml
deleted file mode 100644
index 744e1e8..0000000
--- a/clusters/base/apps/radicale/helmrelease-radicale.yaml
+++ /dev/null
@@ -1,78 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: radicale
-  namespace: pim
-spec:
-  interval: 10m
-  chartRef:
-    kind: OCIRepository
-    name: radicale
-  driftDetection:
-    mode: enabled
-  values:
-    controllers:
-      radicale:
-        containers:
-          app:
-            image:
-              repository: tomsquest/docker-radicale
-              tag: "3.7.6.0"
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-
-    service:
-      app:
-        controller: radicale
-        ports:
-          http:
-            port: 5232
-
-    ingress:
-      app:
-        className: traefik
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          traefik.ingress.kubernetes.io/router.middlewares: pim-radicale-stripprefix@kubernetescrd,pim-radicale-headers@kubernetescrd
-        hosts:
-          - host: c.aggtaa.com
-            paths:
-              - path: /server2
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - secretName: radicale-tls
-            hosts:
-              - c.aggtaa.com
-
-    persistence:
-      config:
-        type: configMap
-        name: radicale-config
-        globalMounts:
-          - path: /config/config
-            subPath: config
-            readOnly: true
-          - path: /config/rights
-            subPath: rights
-            readOnly: true
-      users:
-        type: secret
-        name: radicale-secrets
-        globalMounts:
-          - path: /config/users
-            subPath: users
-            readOnly: true
-      data:
-        type: persistentVolumeClaim
-        accessMode: ReadWriteMany
-        size: 1Gi
-        storageClass: longhorn
-        retain: true
-        globalMounts:
-          - path: /data
diff --git a/clusters/base/apps/radicale/helmrepository.yaml b/clusters/base/apps/radicale/helmrepository.yaml
deleted file mode 100644
index b5397a5..0000000
--- a/clusters/base/apps/radicale/helmrepository.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: radicale
-  namespace: pim
-spec:
-  interval: 10m
-  url: oci://ghcr.io/bjw-s-labs/helm/app-template
-  ref:
-    tag: "5.0.1"
diff --git a/clusters/base/apps/radicale/kustomization.yaml b/clusters/base/apps/radicale/kustomization.yaml
deleted file mode 100644
index 223967c..0000000
--- a/clusters/base/apps/radicale/kustomization.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helmrepository.yaml
-  - secret.enc.yaml
-  - configmap.yaml
-  - middleware.yaml
-  - helmrelease-radicale.yaml
-  - helmrelease-agendav.yaml
diff --git a/clusters/base/apps/radicale/middleware.yaml b/clusters/base/apps/radicale/middleware.yaml
deleted file mode 100644
index 7eede30..0000000
--- a/clusters/base/apps/radicale/middleware.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# middleware order matters!
-
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: radicale-stripprefix
-  namespace: pim
-spec:
-  stripPrefix:
-    prefixes:
-      - /server2
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: radicale-headers
-  namespace: pim
-spec:
-  headers:
-    customRequestHeaders:
-      X-Script-Name: /server2
diff --git a/clusters/base/apps/radicale/secret.enc.yaml b/clusters/base/apps/radicale/secret.enc.yaml
deleted file mode 100644
index a807679..0000000
--- a/clusters/base/apps/radicale/secret.enc.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: radicale-secrets
-    namespace: pim
-stringData:
-    users: ENC[AES256_GCM,data:8o+1aX07mOgu3es/j6n9K4/xTGcj9D9yaGLiwiDWe42uGIlIzbGFFcHNfukw+Z9O6wfOCDZmWnDORWvNtXbwDKDabqT6c8+kZPDGp8pjmQELYRSKJyPMVk1tYAnU6y+A7FhogbN9ixmhbj1L6OpOb9KPHaeMjBj/+cnz4MaU0FKg522ejn57EA==,iv:BmDbKyDv7kQSJwhLEHHKAZEbS0n/NqyEfToTn8esY6o=,tag:DaQ5WWSNZGBFPZqZnsQ59Q==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWUxieThVa3k5a1J1eTNY
-            WGJGWGs3T2JZZFZidXBSVWV0bThSOHhpWkc0CkRZUk1LczVvMCsvL2I1V0J4cjhw
-            ZEVoWUxpS2xiaXhuSVZUckdtWmJyMGMKLS0tIFVFWXJkU1dFemg0aDI2cVZ6eFlO
-            YzZLQXNyZU9VUFExaStzNmpWWDcxSncKr2rkVly2OblJ4T4cgXH85vNBtE4inZuL
-            mUVNmc3uw5TFiFp2j6x2AoM1dDE3fSFLMyPBlnVn/vvuMjayw1ipnw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-19T13:08:04Z"
-    mac: ENC[AES256_GCM,data:Yxa8ndMoFRBh1kOzsbjrUGloVm8tnAbEsHIRucP3OZOxfp711eXB5D0dGTaAPKoTDKx8Kj7AoM2v9QsAUHIVe3s6gQ+tU3DI49FyB/Ie5xSijRmCHFFMUi/Tb8HMWsbDQpFQdDC0e8PW08DIjk9wPhgXN7YDO7myRTEUB/P3A10=,iv:iK0nhutsXpt0L11tG1rWQJS0n4TTApjYp401yyeogkg=,tag:SOCmAkcfn88o/jb9ZraZlg==,type:str]
-    version: 3.13.2
diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml
index d0934cd..853b9fe 100644
--- a/clusters/home/apps/kustomization.yaml
+++ b/clusters/home/apps/kustomization.yaml
@@ -4,7 +4,6 @@ resources:
   - davical.yaml
   - vaultwarden.yaml
   - zigbee2mqtt.yaml
-  - radicale.yaml
   - authelia.yaml
   - mosquitto.yaml
   - homeassistant.yaml
diff --git a/clusters/home/apps/radicale.yaml b/clusters/home/apps/radicale.yaml
deleted file mode 100644
index de50fd5..0000000
--- a/clusters/home/apps/radicale.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: radicale
-  namespace: flux-system
-spec:
-  interval: 10m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./clusters/base/apps/radicale
-  prune: true
-  wait: true
-  dependsOn:
-    - name: namespaces
-    - name: infra
-  retryInterval: 5s
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age