diff --git a/infra/environments/prod/backend.tf b/infra/environments/prod/backend.tf
index edc92c4..dc59f42 100644
--- a/infra/environments/prod/backend.tf
+++ b/infra/environments/prod/backend.tf
@@ -16,10 +16,6 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 6.0"
     }
-    helm = {
-      source  = "hashicorp/helm"
-      version = "~> 3.0"
-    }
     cloudflare = {
       source  = "cloudflare/cloudflare"
       version = "~> 5.0"
@@ -51,20 +47,3 @@ provider "aws" {
     }
   }
 }
-
-# Helm provider authenticates to EKS via `aws eks get-token`, which uses
-# whatever AWS credentials are already in the environment (the OIDC role
-# in CI; the local user otherwise). Both paths have cluster admin —
-# CI via enable_cluster_creator_admin_permissions on the EKS module,
-# local via the cluster_admin_principals access entry.
-provider "helm" {
-  kubernetes = {
-    host                   = module.eks.cluster_endpoint
-    cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
-    exec = {
-      api_version = "client.authentication.k8s.io/v1beta1"
-      command     = "aws"
-      args        = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", "us-west-2"]
-    }
-  }
-}
diff --git a/infra/environments/prod/main.tf b/infra/environments/prod/main.tf
index dcf3f18..7cb8d80 100644
--- a/infra/environments/prod/main.tf
+++ b/infra/environments/prod/main.tf
@@ -20,36 +20,6 @@ module "vpc" {
   cluster_name = local.cluster_name
 }
 
-module "eks" {
-  source = "../../modules/eks"
-
-  name               = local.cluster_name
-  kubernetes_version = "1.35"
-
-  vpc_id     = module.vpc.vpc_id
-  subnet_ids = module.vpc.private_subnet_ids
-
-  # Both the local IAM user (admin-cli) and the CI OIDC role need cluster
-  # admin. Listed explicitly so the set is stable regardless of who runs
-  # terraform — the module's auto-cluster-creator flag is disabled to
-  # avoid the entry flipping between appliers.
-  cluster_admin_principals = [
-    "arn:aws:iam::211125506628:user/admin-cli",
-    "arn:aws:iam::211125506628:role/github-actions-terraform",
-  ]
-}
-
-module "argocd" {
-  source = "../../modules/argocd"
-
-  domain = "argocd.gauchoracing.com"
-
-  # Sentinel-generated client_id for the registered ArgoCD application.
-  oidc_client_id = "b9OrCRXdo1VQ"
-
-  depends_on = [module.eks]
-}
-
 # Wildcard cert for *.gauchoracing.com — every service (argocd, sentinel,
 # whatever else lands later) terminates TLS on its ALB using this cert.
 # Public-facing TLS terminates at the Cloudflare edge using Cloudflare's
@@ -97,10 +67,6 @@ module "postgres" {
   # a known set of admin IPs makes sense.
   associate_public_ip = true
   admin_cidr_blocks   = ["0.0.0.0/0"]
-
-  allowed_security_group_ids = [
-    module.eks.node_security_group_id,
-  ]
 }
 
 # Cloudflare DNS record for the Postgres EIP. Gray-cloud (proxied = false)
@@ -144,10 +110,6 @@ module "mqtt" {
 
   associate_public_ip = true
   admin_cidr_blocks   = ["0.0.0.0/0"]
-
-  allowed_security_group_ids = [
-    module.eks.node_security_group_id,
-  ]
 }
 
 resource "cloudflare_dns_record" "gr_mqtt" {
@@ -185,10 +147,6 @@ module "clickhouse" {
 
   associate_public_ip = true
   admin_cidr_blocks   = ["0.0.0.0/0"]
-
-  allowed_security_group_ids = [
-    module.eks.node_security_group_id,
-  ]
 }
 
 resource "cloudflare_dns_record" "gr_clickhouse" {
diff --git a/infra/environments/prod/outputs.tf b/infra/environments/prod/outputs.tf
index 4d16cab..efbe736 100644
--- a/infra/environments/prod/outputs.tf
+++ b/infra/environments/prod/outputs.tf
@@ -10,18 +10,6 @@ output "public_subnet_ids" {
   value = module.vpc.public_subnet_ids
 }
 
-output "cluster_name" {
-  value = module.eks.cluster_name
-}
-
-output "cluster_endpoint" {
-  value = module.eks.cluster_endpoint
-}
-
-output "cluster_oidc_provider_arn" {
-  value = module.eks.oidc_provider_arn
-}
-
 output "acm_certificate_arn" {
   description = "ACM ARN for the *.gauchoracing.com origin cert. Used in Ingress annotations (or picked up automatically by the ALB controller via SAN match)."
   value       = module.origin_cert.acm_certificate_arn