diff --git a/deploy/k8s/service.yaml b/deploy/k8s/service.yaml
index 574828bc..da77b863 100644
--- a/deploy/k8s/service.yaml
+++ b/deploy/k8s/service.yaml
@@ -121,7 +121,8 @@ metadata:
     app.kubernetes.io/name: shorashim
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch$request_uri
+    # The admission webhook refuses `$request_uri` in this annotation; the bare host is enough for a redirect domain.
+    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch
 spec:
   ingressClassName: nginx
   tls: