diff --git a/clusters/atlas/flux-system/gotk-sync.yaml b/clusters/atlas/flux-system/gotk-sync.yaml
index 26dc23f..006bdd3 100644
--- a/clusters/atlas/flux-system/gotk-sync.yaml
+++ b/clusters/atlas/flux-system/gotk-sync.yaml
@@ -8,7 +8,7 @@ metadata:
 spec:
   interval: 1m0s
   ref:
-    branch: feature/mailu
+    branch: feature/ci-gitops
   secretRef:
     name: flux-system-gitea
   url: ssh://git@scm.bstein.dev:2242/bstein/titan-iac.git
diff --git a/services/gitops-ui/certificate.yaml b/services/gitops-ui/certificate.yaml
new file mode 100644
index 0000000..d16a83a
--- /dev/null
+++ b/services/gitops-ui/certificate.yaml
@@ -0,0 +1,13 @@
+# services/gitops-ui/certificate.yaml
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitops-ui-tls
+  namespace: flux-system
+spec:
+  secretName: gitops-ui-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  dnsNames:
+    - cd.bstein.dev
diff --git a/services/gitops-ui/kustomization.yaml b/services/gitops-ui/kustomization.yaml
index 53a903e..fad837d 100644
--- a/services/gitops-ui/kustomization.yaml
+++ b/services/gitops-ui/kustomization.yaml
@@ -5,3 +5,4 @@ namespace: flux-system
 resources:
   - source.yaml
   - helmrelease.yaml
+  - certificate.yaml