diff --git a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
index 577e0d4f..cbf8cbdf 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
@@ -39,13 +39,13 @@ locals {
     domain_key => "${local.name}-${domain_key}-acm-tls"
   }
 
-  # Rewrite instance domains based on TLS termination mode:
-  # - ACK path: replace ACM ARN with K8s secret name (TLS at Gateway)
-  # - ACM mode: no rewriting needed (base module ignores certificate_reference with external_tls_termination)
-  # - Otherwise: pass through unchanged
+  # Rewrite ACM ARN certificate_reference → K8s secret name for all ACM domains.
+  # In ACM mode (no ACK), this rewrite is harmless — external_tls_termination=true
+  # tells the base module to ignore certificate_reference entirely.
+  # Always rewriting avoids unknown map values when use_ack_acm is unresolved at plan time.
   acm_modified_domains = {
     for domain_key, domain in lookup(var.instance.spec, "domains", {}) :
-    domain_key => local.use_ack_acm && contains(keys(local.acm_cert_secret_names), domain_key) ? merge(domain, {
+    domain_key => contains(keys(local.acm_cert_secret_names), domain_key) ? merge(domain, {
       certificate_reference = local.acm_cert_secret_names[domain_key]
     }) : domain
   }
@@ -146,7 +146,9 @@ locals {
 
   # ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
   # and exports them to K8s TLS secrets for Gateway listener consumption.
-  ack_acm_resources = local.use_ack_acm ? {
+  # Iterates over acm_cert_domains directly (always known from spec) instead of
+  # gating on use_ack_acm which may be unknown on first apply.
+  ack_acm_resources = {
     for domain_key, domain in local.acm_cert_domains :
     "ack-acm-cert-${domain_key}" => {
       apiVersion = "acm.services.k8s.aws/v1alpha1"
@@ -172,7 +174,7 @@ locals {
         }
       }
     }
-  } : {}
+  }
 
   # DNS-01 wildcard certificate resources for cert-manager
   dns01_certificate_resources = {
@@ -228,9 +230,9 @@ module "nginx_gateway_fabric" {
 
 # Pre-create empty TLS secrets for ACK ACM certificate export
 # ACK ACM controller requires the target secret to exist before it can export
-# Only created when ACK controller is available
+# Gated on acm_cert_domains (always known from spec) instead of use_ack_acm
 resource "kubernetes_secret_v1" "acm_cert" {
-  for_each = local.use_ack_acm ? local.acm_cert_domains : {}
+  for_each = local.acm_cert_domains
 
   metadata {
     name      = local.acm_cert_secret_names[each.key]
diff --git a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/variables.tf b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/variables.tf
index 0d889c8c..d861347c 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/variables.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/variables.tf
@@ -16,7 +16,28 @@ variable "cc_metadata" {
 }
 
 variable "instance" {
-  type = any
+  type = object({
+    spec = object({
+      private             = optional(bool, false)
+      disable_base_domain = optional(bool, false)
+      domains = optional(map(object({
+        domain                = string
+        alias                 = string
+        certificate_reference = optional(string)
+      })), {})
+      data_plane             = optional(any)
+      control_plane          = optional(any)
+      rules                  = optional(any, {})
+      force_ssl_redirection  = optional(bool, false)
+      basic_auth             = optional(bool, false)
+      body_size              = optional(string, "150m")
+      helm_values            = optional(any, {})
+      domain_prefix_override = optional(string)
+      helm_wait              = optional(bool, true)
+      use_dns01              = optional(bool, false)
+      dns01_cluster_issuer   = optional(string, "gts-production")
+    })
+  })
 }
 
 variable "instance_name" {
diff --git a/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/variables.tf b/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/variables.tf
index 0d889c8c..d861347c 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/variables.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/variables.tf
@@ -16,7 +16,28 @@ variable "cc_metadata" {
 }
 
 variable "instance" {
-  type = any
+  type = object({
+    spec = object({
+      private             = optional(bool, false)
+      disable_base_domain = optional(bool, false)
+      domains = optional(map(object({
+        domain                = string
+        alias                 = string
+        certificate_reference = optional(string)
+      })), {})
+      data_plane             = optional(any)
+      control_plane          = optional(any)
+      rules                  = optional(any, {})
+      force_ssl_redirection  = optional(bool, false)
+      basic_auth             = optional(bool, false)
+      body_size              = optional(string, "150m")
+      helm_values            = optional(any, {})
+      domain_prefix_override = optional(string)
+      helm_wait              = optional(bool, true)
+      use_dns01              = optional(bool, false)
+      dns01_cluster_issuer   = optional(string, "gts-production")
+    })
+  })
 }
 
 variable "instance_name" {
diff --git a/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/variables.tf b/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/variables.tf
index 0d889c8c..d861347c 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/variables.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/variables.tf
@@ -16,7 +16,28 @@ variable "cc_metadata" {
 }
 
 variable "instance" {
-  type = any
+  type = object({
+    spec = object({
+      private             = optional(bool, false)
+      disable_base_domain = optional(bool, false)
+      domains = optional(map(object({
+        domain                = string
+        alias                 = string
+        certificate_reference = optional(string)
+      })), {})
+      data_plane             = optional(any)
+      control_plane          = optional(any)
+      rules                  = optional(any, {})
+      force_ssl_redirection  = optional(bool, false)
+      basic_auth             = optional(bool, false)
+      body_size              = optional(string, "150m")
+      helm_values            = optional(any, {})
+      domain_prefix_override = optional(string)
+      helm_wait              = optional(bool, true)
+      use_dns01              = optional(bool, false)
+      dns01_cluster_issuer   = optional(string, "gts-production")
+    })
+  })
 }
 
 variable "instance_name" {