diff --git a/nix/treefmt.nix b/nix/treefmt.nix
index f31bef83..a9ca36bd 100644
--- a/nix/treefmt.nix
+++ b/nix/treefmt.nix
@@ -25,7 +25,7 @@ treefmt.evalModule pkgs {
     # --- Nix formatting ---
     nixfmt = {
       enable = true;
-      package = pkgs.nixfmt-rfc-style;
+      package = pkgs.nixfmt;
     };
     statix.enable = true;
     deadnix.enable = true;
diff --git a/values/cilium/env-ekman.yaml.gotmpl b/values/cilium/env-ekman.yaml.gotmpl
index 9c1ed168..216cbe93 100644
--- a/values/cilium/env-ekman.yaml.gotmpl
+++ b/values/cilium/env-ekman.yaml.gotmpl
@@ -12,7 +12,7 @@ cilium:
     enabled: true
   # kube-proxy stays running during migration; disable replacement until done.
   # TODO: set to true after migration
-  kubeProxyReplacement: false
+  kubeProxyReplacement: true
   # Direct apiserver connection -- do not rely on the kubernetes service IP
   # during migration since we are touching the CNI layer.
   # TODO: remove k8sServiceHost / k8sServicePort (or keep pointing at apiserver localhost)
diff --git a/values/cilium/env-hel1.yaml.gotmpl b/values/cilium/env-hel1.yaml.gotmpl
index 8eff95d6..1377dbdb 100644
--- a/values/cilium/env-hel1.yaml.gotmpl
+++ b/values/cilium/env-hel1.yaml.gotmpl
@@ -1,5 +1,7 @@
 cilium:
   enabled: true
+  clustermesh:
+    enabled: false
   envoy:
     enabled: true
   nodePort: