diff --git a/helm/agentic-platform-connectivity/templates/kagent/agents/agentgateway-backends.yaml b/helm/agentic-platform-connectivity/templates/kagent/agents/agentgateway-backends.yaml
index 8246a2c..99f1bce 100644
--- a/helm/agentic-platform-connectivity/templates/kagent/agents/agentgateway-backends.yaml
+++ b/helm/agentic-platform-connectivity/templates/kagent/agents/agentgateway-backends.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.kagent.enabled }}
+{{- if and .Values.kagent.enabled (include "agentic-platform.ingress.agentgateway" .) }}
 {{- $ns := .Values.kagent.namespaceOverride | default .Release.Namespace }}
 {{- range $name, $cfg := .Values.agents.definitions }}
 {{- $agent := merge (dict "name" $name) $cfg }}
@@ -59,31 +59,6 @@ spec:
         - name: {{ $agent.name | quote }}
           kind: AgentgatewayBackend
           group: agentgateway.dev
-{{- if and $.Values.ingress.parentRefs $route.hostname }}
----
-# HTTPRoute — exposes {{ $agent.name }} on the outer public Gateway (TLS-terminating).
-# No URLRewrite: the prefix strip happens at the inner agentgateway hop.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ printf "%s-public" $agent.name | quote }}
-  namespace: {{ $.Release.Namespace }}
-  labels:
-    {{- include "labels.common" $ | nindent 4 }}
-spec:
-  parentRefs:
-    {{- toYaml $.Values.ingress.parentRefs | nindent 4 }}
-  hostnames:
-    - {{ $route.hostname | quote }}
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ $pathPrefix }}
-      backendRefs:
-        - name: {{ $.Values.gateway.name }}
-          port: 8080
-{{- end }}
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/helm/agentic-platform-connectivity/values.yaml b/helm/agentic-platform-connectivity/values.yaml
index 2276628..d78f290 100644
--- a/helm/agentic-platform-connectivity/values.yaml
+++ b/helm/agentic-platform-connectivity/values.yaml
@@ -793,11 +793,12 @@ agents:
             namespace: mcp-kubernetes
       # Agentgateway route — exposes this agent's A2A endpoint at /agents/<name>
       # on the agentgateway inner Gateway (agentgateway-* ingress modes only).
-      # Rendered automatically when the agent is enabled; set hostname to the
-      # agentgateway Gateway hostname. Set ingress.parentRefs to also create
-      # the public HTTPRoute on the outer TLS-terminating Gateway.
+      # Rendered automatically when the agent is enabled. Only in-cluster callers
+      # (other agents, the kagent controller) are expected to use this path; no
+      # public outer HTTPRoute is created. Use extraObjects for external A2A access.
       agentgatewayRoute:
-        # Hostname on which the agentgateway Gateway will match /agents/<name>.
+        # Optional: scope the inner HTTPRoute to a specific hostname on the
+        # agentgateway Gateway. Leave empty to match all hostnames.
         # Example: agentgateway.<cluster>.<base-domain>
         hostname: ""