diff --git a/k8s/README.md b/k8s/README.md
index 7b02a48..aab8b27 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -20,7 +20,7 @@ Traffic flow: **Cloudflare Tunnel** → **Envoy Gateway** → **HTTPRoute** →
 - `gateway.yaml`, `gatewayclass.yaml`, `gateway-certificate.yaml` - Envoy Gateway
 - `gateway-tunnel-service.yaml` - Alias for Cloudflare Tunnel → Gateway
 - `cloudflared-tunnel-deployment.yaml` - Cloudflare Tunnel pod
-- `mcp-service.yaml`, `mcp-referencegrant.yaml`, `referencegrant.yaml` - MCP routing
+- `mcp-service.yaml`, `mcp-referencegrant.yaml` - MCP routing
 
 See `CLOUDFLARE_TUNNEL.md` for tunnel setup.
 
diff --git a/k8s/referencegrant.yaml b/k8s/referencegrant.yaml
deleted file mode 100644
index fc19137..0000000
--- a/k8s/referencegrant.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: ReferenceGrant
-metadata:
-  name: allow-cert-manager-secrets
-  namespace: cert-manager
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      namespace: high-command
-  to:
-    - group: ""
-      kind: Secret
-      name: wildcard-dataknife-ai-tls