diff --git a/manifest/overlays/production/ingress.yaml b/manifest/overlays/production/dev-safe-vmcp-ingress.yaml
similarity index 91%
rename from manifest/overlays/production/ingress.yaml
rename to manifest/overlays/production/dev-safe-vmcp-ingress.yaml
index 3022d9a..9507b4b 100644
--- a/manifest/overlays/production/ingress.yaml
+++ b/manifest/overlays/production/dev-safe-vmcp-ingress.yaml
@@ -4,7 +4,7 @@ metadata:
   name: vmcp-dev-safe-ingress
   namespace: toolhive-system
   labels:
-    app.kubernetes.io/name: vmcp-dev-safe-ingress
+    app.kubernetes.io/name: dev-safe-vmcp
 spec:
   entryPoints:
     - websecure
diff --git a/manifest/overlays/production/full-vmcp-ingress.yaml b/manifest/overlays/production/full-vmcp-ingress.yaml
new file mode 100644
index 0000000..50b44f4
--- /dev/null
+++ b/manifest/overlays/production/full-vmcp-ingress.yaml
@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: full-vmcp-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: full-vmcp
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`full-vmcp.olb42.com`)
+      services:
+        - name: vmcp-full-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: olb42-wildcard-tls
diff --git a/manifest/overlays/production/kustomization.yaml b/manifest/overlays/production/kustomization.yaml
index 2d1de7f..c4842e0 100644
--- a/manifest/overlays/production/kustomization.yaml
+++ b/manifest/overlays/production/kustomization.yaml
@@ -18,6 +18,8 @@ resources:
   - mcp-tool-config-dev.yaml
   - embedding-server.yaml
   - full-vmcp.yaml
+  - full-vmcp-ingress.yaml
   - dev-safe-vmcp.yaml
+  - dev-safe-vmcp-ingress.yaml
   - ops-safe-vmcp.yaml
-  - ingress.yaml
+  - ops-safe-vmcp-ingress.yaml
diff --git a/manifest/overlays/production/ops-safe-vmcp-ingress.yaml b/manifest/overlays/production/ops-safe-vmcp-ingress.yaml
new file mode 100644
index 0000000..4622c1b
--- /dev/null
+++ b/manifest/overlays/production/ops-safe-vmcp-ingress.yaml
@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vmcp-ops-safe-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: ops-safe-vmcp
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`ops-safe.olb42.com`)
+      services:
+        - name: vmcp-ops-safe-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: olb42-wildcard-tls
\ No newline at end of file