diff --git a/services/cilium/deploy/README.md b/services/cilium/deploy/README.md
index 8cdc1f1..9d3efac 100644
--- a/services/cilium/deploy/README.md
+++ b/services/cilium/deploy/README.md
@@ -1,6 +1,6 @@
 # Cilium
 
-<https://github.com/cilium/charts>
+<oci://quay.io/cilium/charts/cilium>
 <https://docs.cilium.io/en/stable/helm-reference/#helm-reference>
 
 ## setup and deploy
@@ -25,3 +25,12 @@ kubectl exec -n cilium  ${POD_NAME} -c cilium-agent -- cilium-dbg status
 ```bash
 kubectl get CiliumLoadBalancerIPPool -A 
 ```
+
+**Force helm:**
+
+```bash
+helm upgrade --install cilium oci://quay.io/cilium/charts/cilium \
+--version 1.19.5 \
+-f ./deploy/app/helm-values.yaml \
+--namespace cilium 
+```
diff --git a/services/cilium/deploy/app/helm-release.yaml b/services/cilium/deploy/app/helm-release.yaml
index e4cdf32..7f90137 100644
--- a/services/cilium/deploy/app/helm-release.yaml
+++ b/services/cilium/deploy/app/helm-release.yaml
@@ -13,12 +13,7 @@ spec:
         kind: HelmRepository
         name: cilium
       interval: 40h
-  values:
-    kubeProxyReplacement: true
-    installCRDs: true
-    routingMode: native
-    enableIPv4Masquerade: true # required even if using bpf.masquerade: true
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-      hostLegacyRouting: false # force use of bfp
+  valuesFrom:
+    - kind: Secret
+      name: cilium-helm-values
+      valuesKey: values.yaml
diff --git a/services/cilium/deploy/app/helm-repo.yaml b/services/cilium/deploy/app/helm-repo.yaml
index ad767e6..3a036ed 100644
--- a/services/cilium/deploy/app/helm-repo.yaml
+++ b/services/cilium/deploy/app/helm-repo.yaml
@@ -4,4 +4,4 @@ metadata:
   name: cilium
 spec:
   interval: 40h
-  url: https://helm.cilium.io
\ No newline at end of file
+  url: oci://quay.io/cilium/charts/cilium
\ No newline at end of file
diff --git a/services/cilium/deploy/app/helm-values.yaml b/services/cilium/deploy/app/helm-values.yaml
new file mode 100644
index 0000000..b1dd702
--- /dev/null
+++ b/services/cilium/deploy/app/helm-values.yaml
@@ -0,0 +1,9 @@
+kubeProxyReplacement: true
+installCRDs: true
+routingMode: native
+enableIPv4Masquerade: true # required even if using bpf.masquerade: true
+autoDirectNodeRoutes: true
+ipv4NativeRoutingCIDR: "10.42.0.0/16"
+bpf:
+  masquerade: true
+  hostLegacyRouting: false # force use of bfp
\ No newline at end of file
diff --git a/services/cilium/deploy/app/kustomization.yaml b/services/cilium/deploy/app/kustomization.yaml
index 1e3fda0..9ea3099 100644
--- a/services/cilium/deploy/app/kustomization.yaml
+++ b/services/cilium/deploy/app/kustomization.yaml
@@ -4,3 +4,9 @@ namespace: cilium
 resources:
  - helm-repo.yaml 
  - helm-release.yaml
+secretGenerator:
+  - name: cilium-helm-values
+    files:
+      - values.yaml=helm-values.yaml
+generatorOptions:
+  disableNameSuffixHash: true
\ No newline at end of file