diff --git a/apps/base/customer1/apigateway.yaml b/apps/base/customer1/apigateway.yaml
index 542db02..1143c8f 100644
--- a/apps/base/customer1/apigateway.yaml
+++ b/apps/base/customer1/apigateway.yaml
@@ -3,18 +3,14 @@ kind: Gateway
 metadata:
   name: external-http-gateway
   namespace: customer1
+  annotations:
+    networking.gke.io/certmap: my-cert-map
 spec:
   gatewayClassName: gke-l7-global-external-managed  # Use gke-l7-global-external-http for external, or gke-l7-rilb for internal
   listeners:
   - name: https 
     protocol: HTTPS 
     port: 443
-    tls:
-      mode: Terminate
-      certificateRefs:
-      - group: networking.gke.io        # This tells K8s it's a GKE-specific resource
-        kind: CertificateMap            # This tells K8s it's not a Secret
-        name: devops-lab-cert-map 
     allowedRoutes:
       namespaces:
-        from: All 
+        from: "All"