diff --git a/apps-kustomized/argocd/argocd-cm.yaml b/apps-kustomized/argocd/argocd-cm.yaml
index fe656ea..7992642 100644
--- a/apps-kustomized/argocd/argocd-cm.yaml
+++ b/apps-kustomized/argocd/argocd-cm.yaml
@@ -6,10 +6,3 @@ metadata:
   name: argocd-cm
 data:
   kustomize.buildOptions: --enable-helm
-  resource.exclusions: |
-  - apiGroups:
-    - cilium.io
-    kinds:
-    - CiliumIdentity
-    clusters:
-    - "*"
diff --git a/apps-kustomized/argocd/exclude-cillium.yaml b/apps-kustomized/argocd/exclude-cillium.yaml
new file mode 100644
index 0000000..027df9d
--- /dev/null
+++ b/apps-kustomized/argocd/exclude-cillium.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/part-of: argocd
+  name: argocd-cm
+data:
+  resource.exclusions: |
+  - apiGroups:
+    - cilium.io
+    kinds:
+    - CiliumIdentity
+    clusters:
+    - "*"
diff --git a/apps-kustomized/argocd/kustomization.yaml b/apps-kustomized/argocd/kustomization.yaml
index c50bccd..fb7c218 100644
--- a/apps-kustomized/argocd/kustomization.yaml
+++ b/apps-kustomized/argocd/kustomization.yaml
@@ -7,3 +7,20 @@ resources:
 patchesStrategicMerge:
 - argocd-cm.yaml
 - service.yaml
+
+patches:
+  - patch: |-
+      - op: add
+        path: /data
+        value:
+          resource.exclusions: |
+            - apiGroups:
+                - cilium.io
+              kinds:
+                - CiliumIdentity
+              clusters:
+                - "*"
+    target:
+      version: v1
+      kind: ConfigMap
+      name: argocd-cm
diff --git a/everything-app/project-apps.yaml b/everything-app/project-apps.yaml
index f7a2b59..c3eb40c 100644
--- a/everything-app/project-apps.yaml
+++ b/everything-app/project-apps.yaml
@@ -4,6 +4,12 @@ metadata:
   name: apps
   namespace: argocd
 spec:
+  clusterResourceBlacklist:
+  - group: "*"
+    kind: "*"
+  clusterResourceBlacklist:
+  - group: cilium.io
+    kind: CiliumIdentity
   description: everything non-infra
   sourceRepos:
   - https://git.martyn.berlin/martyn/infra4talos.git