diff --git a/README.md b/README.md
index 14bd8ea..48c3cdb 100644
--- a/README.md
+++ b/README.md
@@ -141,6 +141,13 @@ helm upgrade --install simulators charts/api-simulators-lab \
      ClusterIssuers from the chart; otherwise an existing `letsencrypt-prod` is used.
    - Let's Encrypt HTTP-01 needs **public DNS** pointing at the Ingress controller
      (not `*.lab.local`).
+   - Each Ingress sets `proxy-intercept-errors: "false"` and
+     `custom-http-errors: "502,503"` so cluster-wide branded HTML (e.g. «DevOps спит»)
+     does not replace simulator JSON/XML for 404/405/401. Do **not** put 404/405 in
+     `custom-http-errors`. After `helm upgrade`, check with
+     `curl -sH 'Accept: application/json' https://<host>/…` — expect API error body,
+     not HTML. If HTML persists, fix controller-level `custom-http-errors` on
+     ingress-nginx (outside this chart).
 
 ---
 
diff --git a/README.ru.md b/README.ru.md
index 9785d59..ca2a8e8 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -141,6 +141,13 @@ helm upgrade --install simulators charts/api-simulators-lab \
      ClusterIssuer из чарта; иначе ожидается уже существующий `letsencrypt-prod`.
    - Let's Encrypt HTTP-01 требует **публичный DNS** на Ingress-контроллер
      (не `*.lab.local`).
+   - На каждом Ingress стоят `proxy-intercept-errors: "false"` и
+     `custom-http-errors: "502,503"`, чтобы кластерный брендированный HTML
+     (например «DevOps спит») не подменял JSON/XML симулятора на 404/405/401.
+     **Не** добавляйте 404/405 в `custom-http-errors`. После `helm upgrade`
+     проверьте: `curl -sH 'Accept: application/json' https://<host>/…` —
+     ожидайте тело ошибки API, не HTML. Если HTML остаётся — править
+     controller-level `custom-http-errors` у ingress-nginx (вне этого чарта).
 
 ---
 
diff --git a/charts/api-simulators-lab/values.yaml b/charts/api-simulators-lab/values.yaml
index 798e1dd..7f4292b 100644
--- a/charts/api-simulators-lab/values.yaml
+++ b/charts/api-simulators-lab/values.yaml
@@ -168,7 +168,11 @@ ingresses:
     tls:
       - secretName: simulators-proxmox-tls
         hosts: [proxmox.lab.local]
-    annotations: {}
+    annotations:
+      # Keep API JSON/XML bodies (404/405/401). Do not list 404/405 here —
+      # cluster custom-http-errors would otherwise replace them with branded HTML.
+      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
 
   ovirt:
     enabled: true
@@ -181,7 +185,9 @@ ingresses:
     tls:
       - secretName: simulators-ovirt-tls
         hosts: [ovirt.lab.local]
-    annotations: {}
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
 
   vmware:
     enabled: true
@@ -195,6 +201,8 @@ ingresses:
       - secretName: simulators-vmware-tls
         hosts: [vmware.lab.local]
     annotations:
+      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
       nginx.ingress.kubernetes.io/configuration-snippet: |
         proxy_set_header X-VMware-Service "vcenter";
         proxy_set_header X-Forwarded-Port "443";
@@ -211,6 +219,8 @@ ingresses:
       - secretName: simulators-openstack-tls
         hosts: [openstack.lab.local]
     annotations:
+      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
       nginx.ingress.kubernetes.io/configuration-snippet: |
         proxy_set_header X-OpenStack-Service "https";
         proxy_set_header X-Forwarded-Port "443";
@@ -224,6 +234,9 @@ ingresses:
   #   tls:
   #     - secretName: simulators-ovirt-ui-tls
   #       hosts: [ovirt-ui.lab.local]
+  #   annotations:
+  #     nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+  #     nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
   # openstack-keystone:
   #   enabled: true
   #   host: keystone.lab.local
@@ -233,6 +246,8 @@ ingresses:
   #     - secretName: simulators-keystone-tls
   #       hosts: [keystone.lab.local]
   #   annotations:
+  #     nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+  #     nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
   #     nginx.ingress.kubernetes.io/configuration-snippet: |
   #       proxy_set_header X-OpenStack-Service "keystone";