diff --git a/tenants/acme/78-servico-saude.yaml b/tenants/acme/78-servico-saude.yaml
index 9abb28d..3b62d09 100644
--- a/tenants/acme/78-servico-saude.yaml
+++ b/tenants/acme/78-servico-saude.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-saude
-          image: docker.io/library/servico-saude:1.6
+          image: docker.io/library/servico-saude:1.88-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
@@ -33,6 +33,16 @@ spec:
             - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
             - { name: ATM_ISSUER, value: "https://auth-acme.athleticmap.influxdigital.com.br/realms/athleticmap" }
             - { name: ATM_TENANT, value: "acme" }
+            # Garmin: DNS devolve IPv6 primeiro e a rota IPv6 do cluster falha; forcar IPv4.
+            - { name: JAVA_TOOL_OPTIONS, value: "-Djava.net.preferIPv4Stack=true" }
+            - { name: GARMIN_REDIRECT_URI, value: "https://acme.athleticmap.influxdigital.com.br/api/public/integrations/garmin/callback" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://acme.athleticmap.influxdigital.com.br/integracoes/garmin" }
+            - name: GARMIN_CLIENT_ID
+              valueFrom:
+                secretKeyRef: { name: garmin-oauth, key: GARMIN_CLIENT_ID }
+            - name: GARMIN_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef: { name: garmin-oauth, key: GARMIN_CLIENT_SECRET }
           resources:
             requests: { cpu: 150m, memory: 320Mi }
             limits: { cpu: "1", memory: 768Mi }
diff --git a/tenants/acme/79-servico-financeiro.yaml b/tenants/acme/79-servico-financeiro.yaml
index aecc3ad..314ec7a 100644
--- a/tenants/acme/79-servico-financeiro.yaml
+++ b/tenants/acme/79-servico-financeiro.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-financeiro
-          image: docker.io/library/servico-financeiro:1.0
+          image: docker.io/library/servico-financeiro:1.4
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
diff --git a/tenants/acme/90-servico-bff.yaml b/tenants/acme/90-servico-bff.yaml
index 0f549f3..2acfe50 100644
--- a/tenants/acme/90-servico-bff.yaml
+++ b/tenants/acme/90-servico-bff.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-bff
-          image: docker.io/library/servico-bff:1.33
+          image: docker.io/library/servico-bff:1.87-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
@@ -40,6 +40,7 @@ spec:
             - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
             - { name: ATM_ISSUER, value: "https://auth-acme.athleticmap.influxdigital.com.br/realms/athleticmap" }
             - { name: ATM_TENANT, value: "acme" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://acme.athleticmap.influxdigital.com.br/integracoes/garmin" }
           resources:
             requests: { cpu: 100m, memory: 256Mi }
             limits: { cpu: 500m, memory: 512Mi }
diff --git a/tenants/acme/95-frontend-spa.yaml b/tenants/acme/95-frontend-spa.yaml
index 6740e6a..ee54d86 100644
--- a/tenants/acme/95-frontend-spa.yaml
+++ b/tenants/acme/95-frontend-spa.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: frontend-spa
-          image: docker.io/library/frontend-spa:1.74
+          image: docker.io/library/frontend-spa:1.90-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 80 }]
           env:
diff --git a/tenants/acme/96-ingress-garmin-patch.yaml b/tenants/acme/96-ingress-garmin-patch.yaml
new file mode 100644
index 0000000..2e1d97d
--- /dev/null
+++ b/tenants/acme/96-ingress-garmin-patch.yaml
@@ -0,0 +1 @@
+# Patch manual: /api/public roteado ao BFF (Garmin OAuth callback)
diff --git a/tenants/acme/96-ingress-garmin-public.yaml b/tenants/acme/96-ingress-garmin-public.yaml
new file mode 100644
index 0000000..9682a42
--- /dev/null
+++ b/tenants/acme/96-ingress-garmin-public.yaml
@@ -0,0 +1,25 @@
+# Rota publica Garmin OAuth callback (BFF)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: acme-garmin-public
+  namespace: acme-prod
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: acme-prod-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [acme.athleticmap.influxdigital.com.br]
+      secretName: acme-tls
+  rules:
+    - host: acme.athleticmap.influxdigital.com.br
+      http:
+        paths:
+          - path: /api/public
+            pathType: Prefix
+            backend:
+              service:
+                name: servico-bff
+                port:
+                  number: 80
diff --git a/tenants/demo/79-servico-financeiro.yaml b/tenants/demo/79-servico-financeiro.yaml
index 0c8a8e1..d66c179 100644
--- a/tenants/demo/79-servico-financeiro.yaml
+++ b/tenants/demo/79-servico-financeiro.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-financeiro
-          image: docker.io/library/servico-financeiro:1.0
+          image: docker.io/library/servico-financeiro:1.4
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
diff --git a/tenants/demo/96-ingress-garmin-patch.yaml b/tenants/demo/96-ingress-garmin-patch.yaml
new file mode 100644
index 0000000..2e1d97d
--- /dev/null
+++ b/tenants/demo/96-ingress-garmin-patch.yaml
@@ -0,0 +1 @@
+# Patch manual: /api/public roteado ao BFF (Garmin OAuth callback)
diff --git a/tenants/piloto/78-servico-saude.yaml b/tenants/piloto/78-servico-saude.yaml
index 1df46cc..ccac369 100644
--- a/tenants/piloto/78-servico-saude.yaml
+++ b/tenants/piloto/78-servico-saude.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-saude
-          image: docker.io/library/servico-saude:1.6
+          image: docker.io/library/servico-saude:1.88-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
@@ -33,6 +33,16 @@ spec:
             - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
             - { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.influxdigital.com.br/realms/athleticmap" }
             - { name: ATM_TENANT, value: "piloto" }
+            # Garmin: DNS devolve IPv6 primeiro e a rota IPv6 do cluster falha; forcar IPv4.
+            - { name: JAVA_TOOL_OPTIONS, value: "-Djava.net.preferIPv4Stack=true" }
+            - { name: GARMIN_REDIRECT_URI, value: "https://piloto.athleticmap.influxdigital.com.br/api/public/integrations/garmin/callback" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://piloto.athleticmap.influxdigital.com.br/integracoes/garmin" }
+            - name: GARMIN_CLIENT_ID
+              valueFrom:
+                secretKeyRef: { name: garmin-oauth, key: GARMIN_CLIENT_ID }
+            - name: GARMIN_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef: { name: garmin-oauth, key: GARMIN_CLIENT_SECRET }
           resources:
             requests: { cpu: 150m, memory: 320Mi }
             limits: { cpu: "1", memory: 768Mi }
diff --git a/tenants/piloto/90-servico-bff.yaml b/tenants/piloto/90-servico-bff.yaml
index 5641954..6dfc0a7 100644
--- a/tenants/piloto/90-servico-bff.yaml
+++ b/tenants/piloto/90-servico-bff.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: servico-bff
-          image: docker.io/library/servico-bff:1.33
+          image: docker.io/library/servico-bff:1.87-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 8083 }]
           env:
@@ -40,6 +40,7 @@ spec:
             - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
             - { name: ATM_ISSUER, value: "https://auth-piloto.athleticmap.influxdigital.com.br/realms/athleticmap" }
             - { name: ATM_TENANT, value: "piloto" }
+            - { name: GARMIN_FRONTEND_REDIRECT, value: "https://piloto.athleticmap.influxdigital.com.br/integracoes/garmin" }
           resources:
             requests: { cpu: 100m, memory: 256Mi }
             limits: { cpu: 500m, memory: 512Mi }
diff --git a/tenants/piloto/95-frontend-spa.yaml b/tenants/piloto/95-frontend-spa.yaml
index 36824b1..137ec59 100644
--- a/tenants/piloto/95-frontend-spa.yaml
+++ b/tenants/piloto/95-frontend-spa.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: frontend-spa
-          image: docker.io/library/frontend-spa:1.74
+          image: docker.io/library/frontend-spa:1.90-garmin
           imagePullPolicy: Never
           ports: [{ containerPort: 80 }]
           env:
diff --git a/tenants/piloto/96-ingress-garmin-patch.yaml b/tenants/piloto/96-ingress-garmin-patch.yaml
new file mode 100644
index 0000000..2e1d97d
--- /dev/null
+++ b/tenants/piloto/96-ingress-garmin-patch.yaml
@@ -0,0 +1 @@
+# Patch manual: /api/public roteado ao BFF (Garmin OAuth callback)
diff --git a/tenants/piloto/96-ingress-garmin-public.yaml b/tenants/piloto/96-ingress-garmin-public.yaml
new file mode 100644
index 0000000..ec4d4bc
--- /dev/null
+++ b/tenants/piloto/96-ingress-garmin-public.yaml
@@ -0,0 +1,25 @@
+# Rota publica Garmin OAuth callback (BFF)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: piloto-garmin-public
+  namespace: piloto-prod
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: piloto-prod-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [piloto.athleticmap.influxdigital.com.br]
+      secretName: piloto-tls
+  rules:
+    - host: piloto.athleticmap.influxdigital.com.br
+      http:
+        paths:
+          - path: /api/public
+            pathType: Prefix
+            backend:
+              service:
+                name: servico-bff
+                port:
+                  number: 80