diff --git a/deploy-lab.sh b/deploy-lab.sh
index 972291a..faaf71d 100644
--- a/deploy-lab.sh
+++ b/deploy-lab.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Script Maestro: Despliegue Estable de Laboratorio (ZimaOS + k3d + ArgoCD)
+# Script Maestro Final: Laboratorio Estable (ZimaOS + k3d + ArgoCD + Headlamp)
 set -e
 
 CLUSTER_NAME="lab-cluster"
@@ -12,7 +12,7 @@ sudo chmod -R 777 $APP_DATA_PATH/
 echo "--- 2. Limpiando clúster previo ---"
 k3d cluster delete $CLUSTER_NAME || true
 
-echo "--- 3. Creando clúster con persistencia ---"
+echo "--- 3. Creando clúster ---"
 k3d cluster create $CLUSTER_NAME \
   --api-port 46421 \
   -p "90:80@loadbalancer" \
@@ -21,29 +21,44 @@ k3d cluster create $CLUSTER_NAME \
   -v "$APP_DATA_PATH/argocd:/var/lib/argocd" \
   --agents 2
 
-echo "--- 4. Configurando reinicio automático ---"
+echo "--- 4. Configurando reinicio y Kubeconfig ---"
 sudo docker update --restart=always $(sudo docker ps -a -q -f name=k3d)
-
-echo "--- 5. Configurando Kubeconfig ---"
 sudo chown -R $USER:$USER /DATA/.kube /DATA/.config
 k3d kubeconfig merge $CLUSTER_NAME --kubeconfig-switch-context
 
-echo "--- 6. Instalando ArgoCD ---"
+echo "--- 5. Instalando ArgoCD y configurando Insecure ---"
 kubectl create namespace argocd || true
+
+//
+
+echo "--- 5. Instalando ArgoCD y RBAC ---"
+kubectl create namespace argocd || true
+
+# RBAC dedicado
+kubectl create serviceaccount argocd-manager -n argocd || true
+kubectl create clusterrolebinding argocd-manager-binding \
+  --clusterrole=cluster-admin \
+  --serviceaccount=argocd:argocd-manager || true
+
+# Despliegue de ArgoCD
 kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
 
-echo "--- 7. Validando estado del clúster (Esperando a que esté Ready) ---"
-echo "Esperando nodos..."
-kubectl wait --for=condition=Ready nodes --all --timeout=120s
-echo "Esperando pods de ArgoCD..."
-kubectl wait --for=condition=Ready pods -n argocd --all --timeout=120s
-
-echo "--- 8. Ajustando modo Insecure (Proxy-Friendly) ---"
+# Esperar a que la API responda para hacer el patch
+sleep 15
 kubectl patch configmap argocd-cmd-params-cm -n argocd --type merge -p '{"data":{"server.insecure":"true"}}'
-kubectl rollout restart deployment argocd-server -n argocd
-kubectl rollout status deployment argocd-server -n argocd --timeout=60s
 
-echo "--- 9. Aplicando Ingress (Traefik) ---"
+echo "--- 6. Creando credenciales para Headlamp ---"
+kubectl create namespace headlamp || true
+kubectl create serviceaccount headlamp-admin -n headlamp || true
+kubectl create clusterrolebinding headlamp-admin-binding --clusterrole=cluster-admin --serviceaccount=headlamp:headlamp-admin || true
+
+# Creamos el secreto para que Headlamp use el config del host
+kubectl create secret generic headlamp-kubeconfig --from-file=config=/DATA/.kube/config -n headlamp --dry-run=client -o yaml | kubectl apply -f -
+
+echo "--- 7. Validando despliegue ---"
+kubectl wait --for=condition=Ready pods -n argocd --all --timeout=180s
+
+echo "--- 8. Aplicando Ingress para balanceador ---"
 cat <<EOF | kubectl apply -f -
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -68,9 +83,15 @@ spec:
 EOF
 
 echo "=========================================================="
-echo " LABORATORIO DESPLEGADO Y VALIDADO"
-echo " URL: https://argocd.cruzcloud.net"
-echo " Usuario: admin"
-PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
-echo " Password: $PASS"
+echo " LABORATORIO DESPLEGADO EXITOSAMENTE"
+echo " IMPORTANTE - NOTA PARA NGINX PROXY MANAGER:"
+echo " -------------------------------------------"
+echo " En la configuración de cada host en NPM:"
+echo " 1. Forward Hostname: 192.168.68.61"
+echo " 2. Forward Port: 90"
+echo " 3. Scheme: http"
+echo " 4. HABILITAR 'Websockets Support' (Obligatorio)"
+echo " =========================================================="
+echo " ArgoCD Password: $(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)"
+echo " Token Headlamp: $(kubectl create token headlamp-admin -n headlamp)"
 echo "=========================================================="
\ No newline at end of file