diff --git a/services/crypto/monerod/ingress.yaml b/services/crypto/monerod/ingress.yaml
new file mode 100644
index 0000000..1ac06c7
--- /dev/null
+++ b/services/crypto/monerod/ingress.yaml
@@ -0,0 +1,25 @@
+# services/crypto/monerod/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: monerod
+  namespace: crypto
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  tls:
+    - hosts: [ "monero.bstein.dev" ]
+      secretName: monero-bstein-dev-tls
+  rules:
+    - host: monero.bstein.dev
+      http:
+        paths:
+          - pathType: Prefix
+            path: /
+            backend:
+              service:
+                name: monerod
+                port: { number: 18081 }
diff --git a/services/crypto/monerod/kustomization.yaml b/services/crypto/monerod/kustomization.yaml
index 73b6cf6..d6c1b19 100644
--- a/services/crypto/monerod/kustomization.yaml
+++ b/services/crypto/monerod/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - cm-release-keys.yaml
   - deployment.yaml
   - service.yaml
+  - ingress.yaml
diff --git a/services/pegasus/deployment.yaml b/services/pegasus/deployment.yaml
index 3a10dfe..34270b0 100644
--- a/services/pegasus/deployment.yaml
+++ b/services/pegasus/deployment.yaml
@@ -16,7 +16,8 @@ spec:
     metadata: { labels: { app: pegasus } }
     spec:
       nodeSelector:
-        kubernetes.io/arch: amd64
+        kubernetes.io/arch: arm64
+        node-role.kubernetes.io/worker: "true"
       securityContext:
         runAsNonRoot: true
         runAsUser: 65532