diff --git a/Makefile b/Makefile
index 0eacbeda..7a3d860f 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ endif
 
 # Image URL to use all building/pushing image targets
 REGISTRY ?= ghcr.io/datasance
-VERSION_TAG ?= 3.7.0
+VERSION_TAG ?= 3.7.1
 IMG ?= $(REGISTRY)/operator:$(VERSION_TAG)
 BUNDLE_IMG ?= $(REGISTRY)/operator-bundle:$(VERSION_TAG)
 # Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
diff --git a/controllers/controlplanes/microservices.go b/controllers/controlplanes/microservices.go
index 969435d4..7e1a87e7 100644
--- a/controllers/controlplanes/microservices.go
+++ b/controllers/controlplanes/microservices.go
@@ -1348,9 +1348,13 @@ func getCAValue(ca *string) string {
 	return *ca
 }
 
-// getTrafficPolicy returns the externalTrafficPolicy for a service. When override is set to "Local" or "Cluster" it is used;
-// when omitted, LoadBalancer defaults to Local and other types to Cluster (valid K8s values only).
+// getTrafficPolicy returns the externalTrafficPolicy for a service. Only LoadBalancer and NodePort
+// may have this field set; for ClusterIP it must be empty. When override is "Local" or "Cluster" it
+// is used; when omitted, LoadBalancer defaults to Local and NodePort to Cluster.
 func getTrafficPolicy(serviceType string, override string) string {
+	if strings.EqualFold(serviceType, string(corev1.ServiceTypeClusterIP)) {
+		return ""
+	}
 	if strings.EqualFold(override, string(corev1.ServiceExternalTrafficPolicyTypeLocal)) {
 		return string(corev1.ServiceExternalTrafficPolicyTypeLocal)
 	}
@@ -1360,5 +1364,8 @@ func getTrafficPolicy(serviceType string, override string) string {
 	if strings.EqualFold(serviceType, string(corev1.ServiceTypeLoadBalancer)) {
 		return string(corev1.ServiceExternalTrafficPolicyTypeLocal)
 	}
-	return string(corev1.ServiceExternalTrafficPolicyTypeCluster)
+	if strings.EqualFold(serviceType, string(corev1.ServiceTypeNodePort)) {
+		return string(corev1.ServiceExternalTrafficPolicyTypeCluster)
+	}
+	return ""
 }
diff --git a/controllers/controlplanes/resources.go b/controllers/controlplanes/resources.go
index 18c26df8..4c4a352d 100644
--- a/controllers/controlplanes/resources.go
+++ b/controllers/controlplanes/resources.go
@@ -73,12 +73,14 @@ func newServices(namespace, instanceName string, ms *microservice) (svcs []*core
 				Annotations: msvcSvc.serviceAnnotations,
 			},
 			Spec: corev1.ServiceSpec{
-				Type:                  corev1.ServiceType(msvcSvc.serviceType),
-				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyType(msvcSvc.trafficPolicy),
-				LoadBalancerIP:        msvcSvc.loadBalancerAddr,
-				Selector:              labels,
+				Type:           corev1.ServiceType(msvcSvc.serviceType),
+				LoadBalancerIP: msvcSvc.loadBalancerAddr,
+				Selector:       labels,
 			},
 		}
+		if msvcSvc.trafficPolicy != "" {
+			svc.Spec.ExternalTrafficPolicy = corev1.ServiceExternalTrafficPolicyType(msvcSvc.trafficPolicy)
+		}
 		if msvcSvc.headless {
 			svc.Spec.ClusterIP = corev1.ClusterIPNone
 		}
@@ -104,6 +106,11 @@ func newControllerIngress(namespace, instanceName string, cfg *controllerIngress
 	pathType := networkingv1.PathTypePrefix
 	labels := getStandardLabels("controller", instanceName)
 
+	var ingressClassName *string
+	if cfg.ingressClassName != "" {
+		ingressClassName = &cfg.ingressClassName
+	}
+
 	return &networkingv1.Ingress{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:        "pot-controller",
@@ -112,7 +119,7 @@ func newControllerIngress(namespace, instanceName string, cfg *controllerIngress
 			Annotations: cfg.annotations,
 		},
 		Spec: networkingv1.IngressSpec{
-			IngressClassName: &cfg.ingressClassName,
+			IngressClassName: ingressClassName,
 			TLS: []networkingv1.IngressTLS{
 				{
 					Hosts:      []string{cfg.host},
diff --git a/go.mod b/go.mod
index 04ad5976..032579ce 100644
--- a/go.mod
+++ b/go.mod
@@ -70,6 +70,11 @@ require (
 )
 
 retract (
+	v3.7.1-beta.0 // Fixed.
+	v3.7.0 // Fixed.
+	v3.7.0-beta.2 // beta build fixed.
+	v3.7.0-beta.1 // beta build fixed.
+	v3.7.0-beta.0 // beta build fixed.
 	v3.5.3 // Published accidentally.
 	v3.4.15 // retract as db migration scripts fixed.
 	v3.4.14 // retract as db migration scripts fixed.
@@ -89,4 +94,5 @@ retract (
 	v3.2.3 // Published accidentally.
 	v3.2.2 // Published accidentally.
 	v3.2.1 // Published accidentally.
+
 )