Pick the balancer by which headers and ports you must inspect, not by the logo on the console. Layer-4 NLB paths stay cheap when you only need port and IP affinity, health on TCP, and TLS passthrough to the backend that owns the certificate. Layer-7 ALB paths earn their cost when you need host or path rules, header-based canaries, or to terminate TLS once at the edge and speak plain to a private target group. Mixing both usually means the wrong layer is rewriting Host or draining mid-flight.

Ops prove-out after a cutover: send a sticky canary Host through the new listener and confirm target health, certificate SAN, and drain behaviour under a rolling replace. Watch connection resets while targets leave the pool — a spike usually means the idle timeout or deregistration delay is shorter than your long poll. After switching layers, compare p99 and active flow count at the same RPS; if L7 latency jumps with no backend change, you are paying for inspection you do not use.