diff --git a/roles/openshift-apps/forgejo/tasks/main.yaml b/roles/openshift-apps/forgejo/tasks/main.yaml
index 122be0ec14..7f9ffdfeb8 100644
--- a/roles/openshift-apps/forgejo/tasks/main.yaml
+++ b/roles/openshift-apps/forgejo/tasks/main.yaml
@@ -68,9 +68,9 @@
 - name: Deploy Forgejo via Helm
   ansible.builtin.include_tasks: call-helm.yaml
 
-#- name: Point forgejo-http Service at oauth-proxy sidecar (staging)
-#  ansible.builtin.include_tasks: patch-forgejo-http-service-oauth-proxy.yaml
-#  when: env == "staging"
+- name: Point forgejo-http Service at oauth-proxy sidecar (staging)
+  ansible.builtin.include_tasks: patch-forgejo-http-service-oauth-proxy.yaml
+  when: env == "staging"
 
 - name: Load forgejo runners
   ansible.builtin.include_tasks: load-forgejo-runners.yaml
diff --git a/roles/openshift-apps/forgejo/templates/values.yaml.j2 b/roles/openshift-apps/forgejo/templates/values.yaml.j2
index cbbc676d60..b7a1fdb459 100644
--- a/roles/openshift-apps/forgejo/templates/values.yaml.j2
+++ b/roles/openshift-apps/forgejo/templates/values.yaml.j2
@@ -347,6 +347,8 @@ extraContainers:
         containerPort: {{ forgejo_metrics_oauth_proxy_port }}
     args:
       - --http-address=:{{ forgejo_metrics_oauth_proxy_port }}
+      # Disable default :443 listener; edge-terminated Route provides TLS.
+      - --https-address=
       - --provider=openshift
       - --openshift-service-account=forgejo-http
       - --upstream=http://127.0.0.1:3000/