Zero-downtime Ingress NGINX to Gateway API cutovers fail when both controllers briefly claim the same Host without shared readiness. Stand up a distinct GatewayClass and listeners first, dual-publish only one Host at a time, and keep the old IngressClass on leftovers until DNS, TLS SNI, and Endpoint readiness agree. Terminate TLS on a single layer during the move — splitting certs between the load balancer and the Gateway listener usually shows as intermittent handshake resets that look like upstream 502s.

Ops prove-out per Host: confirm the Gateway reports programmed addresses and Accepted routes, then hit the public name and expect the upstream status, not a default backend. Drain the old Ingress rule only after two consecutive healthy probes and matching response headers. If a single path breaks, compare Service port names to the backend portRefs and check NetworkPolicies still allow node-to-pod traffic — most rollback-worthy cutovers are parentRef or class mismatch, not the route YAML shape.