diff --git a/manifest/overlays/production/ingress.yaml b/manifest/overlays/production/ingress.yaml
index 4b3dd8e..3e0bb2c 100644
--- a/manifest/overlays/production/ingress.yaml
+++ b/manifest/overlays/production/ingress.yaml
@@ -1,37 +1,21 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
 metadata:
   name: vmcp-dev-safe-ingress
   namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: vmcp-dev-safe-ingress
 spec:
-  ingressClassName: traefik
-  rules:
-    - host: dev-safe.olb42.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: vmcp-dev-safe-vmcp
-                port:
-                  number: 4483
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vmcp-ops-safe-ingress
-  namespace: toolhive-system
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: ops-safe.olb42.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: vmcp-ops-safe-vmcp
-                port:
-                  number: 4483
\ No newline at end of file
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`ops-safe.olb42.com`)
+      services:
+        - name: vmcp-dev-safe-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: olb42-wildcard-tls