diff --git a/apps/system/cilium.yaml b/apps/system/cilium.yaml
new file mode 100644
index 0000000..a3194ee
--- /dev/null
+++ b/apps/system/cilium.yaml
@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-999999"
+spec:
+  project: system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: kube-system
+  source:
+    chart: cilium
+    repoURL: https://helm.cilium.io/
+    targetRevision: 1.16.4
+    helm:
+      releaseName: cilium
+      valuesObject:
+        operator:
+          replicas: 1
+
+        ipam:
+          operator:
+            clusterPoolIPv4PodCIDRList: "10.42.0.0/16"
+
+        kubeProxyReplacement: true
+        k8sServiceHost: "172.16.1.1" # internal IP (Hetzner Cloud Network)
+        k8sServicePort: "6443"