diff --git a/ansible/arcodange/factory/playbooks/system/k3s_ssl.yml b/ansible/arcodange/factory/playbooks/system/k3s_ssl.yml
index f904db9..26606fd 100644
--- a/ansible/arcodange/factory/playbooks/system/k3s_ssl.yml
+++ b/ansible/arcodange/factory/playbooks/system/k3s_ssl.yml
@@ -162,4 +162,11 @@
                     name: {{ jwk_secret_name }}
                     namespace: {{ namespace }}
                     key: password
+              # Override kube-rbac-proxy image to use ARM64-compatible version.
+              # Note: pi3 (ARM64) requires an ARM64-compatible image, while pi2 (ARMv7) may work with AMD64 images.
+              # The default image (gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0) is AMD64-only and fails on pi3.
+              kubeRBACproxy:
+                image:
+                  repository: quay.io/brancz/kube-rbac-proxy
+                  tag: v0.15.0