diff --git a/workloads/ecommerce/frontend.yaml b/workloads/ecommerce/frontend.yaml
deleted file mode 100644
index aa99c6b..0000000
--- a/workloads/ecommerce/frontend.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend-deploy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      imagePullSecrets:
-      - name: gitea-registry-secret
-      containers:
-      - name: web
-        image: gitea.cruzcloud.net/devops/ecommerce-frontend:v1.0.104
-        ports:
-        - containerPort: 80
-        env:
-        - name: HEADLESS_PROVIDER
-          value: medusa
-        - name: MEDUSA_BACKEND_URL
-          value: http://medusa-svc:9000
-        - name: MEDUSA_REGION_ID
-          value: reg_01KZT86WPAH7A7ZZRDSX3350V2
-        envFrom:
-        - secretRef:
-            name: commerce-storefront
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-spec:
-  selector:
-    app: frontend
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 80
\ No newline at end of file
diff --git a/workloads/ecommerce/frontend/kustomization.yaml b/workloads/ecommerce/frontend/kustomization.yaml
new file mode 100644
index 0000000..430c9fb
--- /dev/null
+++ b/workloads/ecommerce/frontend/kustomization.yaml
@@ -0,0 +1,53 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ecommerce
+
+resources:
+  - https://gitea.cruzcloud.net/devops/platform-templates.git//k8s-manifests/base?ref=main
+
+patches:
+  # frontend comparte "ecommerce-ingress" con catalog-api-svc (path-based,
+  # un solo Ingress con 2 backends) -- no le corresponde el Ingress
+  # genérico de 1-backend del base. Se borra del output de este overlay;
+  # ecommerce-ingress se queda tal cual está, definido fuera de acá.
+  # (Kustomize no soporta referenciar solo algunos archivos de un
+  # directorio remoto vía git -- probado en vivo, "expecting directory".
+  # Traer el base completo y borrar lo que no aplica es el patrón real.)
+  - target:
+      kind: Ingress
+      name: app-ingress
+    patch: |-
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: app-ingress
+  - target:
+      kind: Deployment
+      name: app-deployment
+    path: patches/deployment.yaml
+  - target:
+      kind: Service
+      name: app-svc
+    path: patches/service.yaml
+
+  - target:
+      kind: Deployment
+      name: app-deployment
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: frontend-deploy
+      - op: replace
+        path: /spec/template/spec/containers/0/ports
+        value:
+          - name: http
+            containerPort: 80
+  - target:
+      kind: Service
+      name: app-svc
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: frontend-svc
diff --git a/workloads/ecommerce/frontend/patches/deployment.yaml b/workloads/ecommerce/frontend/patches/deployment.yaml
new file mode 100644
index 0000000..4c5774a
--- /dev/null
+++ b/workloads/ecommerce/frontend/patches/deployment.yaml
@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-deployment
+  labels:
+    app: frontend
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: frontend
+  template:
+    metadata:
+      labels:
+        app: frontend
+    spec:
+      containers:
+        - name: app
+          image: gitea.cruzcloud.net/devops/ecommerce-frontend:v1.0.104
+          env:
+            - name: HEADLESS_PROVIDER
+              value: medusa
+            - name: MEDUSA_BACKEND_URL
+              value: http://medusa-svc:9000
+            - name: MEDUSA_REGION_ID
+              value: reg_01KZT86WPAH7A7ZZRDSX3350V2
+          envFrom:
+            - secretRef:
+                name: commerce-storefront
+          # El base usa "/" por default. El Dockerfile de frontend ya
+          # define su propio HEALTHCHECK contra /api/health -- usamos
+          # el mismo endpoint acá en vez del genérico del base, ya
+          # sabemos que existe y responde.
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+          # El Dockerfile de frontend ya corre como usuario "nextjs" no-root
+          # (a diferencia de docs-portal) -- runAsNonRoot: true del base
+          # se queda tal cual, sin override.
+          #
+          # Sí hace falta NET_BIND_SERVICE: el puerto real es 80
+          # (privilegiado, <1024). El Dockerfile ya hace setcap sobre el
+          # binario de node para esto, pero eso solo funciona si el
+          # bounding set del contenedor lo permite -- drop: ALL del base
+          # lo bloquea igual, root o no root. Mismo motivo que docs-portal.
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_BIND_SERVICE
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 768Mi
diff --git a/workloads/ecommerce/frontend/patches/service.yaml b/workloads/ecommerce/frontend/patches/service.yaml
new file mode 100644
index 0000000..533f611
--- /dev/null
+++ b/workloads/ecommerce/frontend/patches/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: app-svc
+spec:
+  selector:
+    app: frontend
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
diff --git a/workloads/ecommerce/kustomization.yaml b/workloads/ecommerce/kustomization.yaml
index 08f8c58..afd6e22 100644
--- a/workloads/ecommerce/kustomization.yaml
+++ b/workloads/ecommerce/kustomization.yaml
@@ -2,19 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - frontend.yaml
+  - frontend/
   - catalog-api.yaml
   - ingress.yaml
 
   - commerce/
 patches:
-  - path: patches/frontend-resources.yaml
-    target:
-      group: apps
-      version: v1
-      kind: Deployment
-      name: frontend-deploy
-
   - path: patches/catalog-resources.yaml
     target:
       group: apps
diff --git a/workloads/ecommerce/patches/frontend-resources.yaml b/workloads/ecommerce/patches/frontend-resources.yaml
deleted file mode 100644
index cac50c2..0000000
--- a/workloads/ecommerce/patches/frontend-resources.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend-deploy
-spec:
-  replicas: 2
-
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
-
-  template:
-    spec:
-      containers:
-        - name: web
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 768Mi
\ No newline at end of file