diff --git a/services/comms/helmrelease.yaml b/services/comms/helmrelease.yaml
index 2b049c80..bf45b217 100644
--- a/services/comms/helmrelease.yaml
+++ b/services/comms/helmrelease.yaml
@@ -135,6 +135,7 @@ spec:
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
       csHosts:
         - matrix.live.bstein.dev
       hosts:
@@ -395,6 +396,7 @@ spec:
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
       hosts:
         - live.bstein.dev
       tls:
diff --git a/services/gitops-ui/helmrelease.yaml b/services/gitops-ui/helmrelease.yaml
index 86ae3272..671dfe37 100644
--- a/services/gitops-ui/helmrelease.yaml
+++ b/services/gitops-ui/helmrelease.yaml
@@ -33,6 +33,7 @@ spec:
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
       hosts:
         - host: cd.bstein.dev
           paths:
diff --git a/services/jenkins/ingress.yaml b/services/jenkins/ingress.yaml
index e702c8c6..611eae44 100644
--- a/services/jenkins/ingress.yaml
+++ b/services/jenkins/ingress.yaml
@@ -7,6 +7,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik
   tls:
diff --git a/services/logging/ingress.yaml b/services/logging/ingress.yaml
index 7beeb9a6..eafeb5df 100644
--- a/services/logging/ingress.yaml
+++ b/services/logging/ingress.yaml
@@ -6,6 +6,8 @@ metadata:
   namespace: logging
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik
   tls:
diff --git a/services/monitoring/helmrelease.yaml b/services/monitoring/helmrelease.yaml
index 3ff3f0cb..c99a8cad 100644
--- a/services/monitoring/helmrelease.yaml
+++ b/services/monitoring/helmrelease.yaml
@@ -322,6 +322,8 @@ spec:
       ingressClassName: traefik
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
       hosts:
         - metrics.bstein.dev
       path: /
@@ -503,6 +505,8 @@ spec:
       ingressClassName: traefik
       annotations:
         cert-manager.io/cluster-issuer: letsencrypt
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
       hosts:
         - host: alerts.bstein.dev
           paths:
diff --git a/services/nextcloud/collabora.yaml b/services/nextcloud/collabora.yaml
index 0f09c79d..8a878215 100644
--- a/services/nextcloud/collabora.yaml
+++ b/services/nextcloud/collabora.yaml
@@ -61,6 +61,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   tls:
     - hosts:
diff --git a/services/nextcloud/ingress.yaml b/services/nextcloud/ingress.yaml
index 1c60282d..0df2660d 100644
--- a/services/nextcloud/ingress.yaml
+++ b/services/nextcloud/ingress.yaml
@@ -7,6 +7,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   tls:
     - hosts:
diff --git a/services/vault/ingress.yaml b/services/vault/ingress.yaml
index 1d9d523f..b768381c 100644
--- a/services/vault/ingress.yaml
+++ b/services/vault/ingress.yaml
@@ -7,6 +7,7 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: traefik
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik
   tls: