diff --git a/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml b/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
index d8c307e..d48a0b0 100644
--- a/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
+++ b/manifest/overlays/production/vmcp-servers/full-vmcp-ingress.yaml
@@ -19,12 +19,6 @@ spec:
         - name: vmcp-full-vmcp
           namespace: toolhive-system
           port: 4483
-    - kind: Rule
-      match: Host(`full-vmcp.ngorse.com`)
-      services:
-        - name: vmcp-full-vmcp
-          namespace: toolhive-system
-          port: 4483
   # No default TLSStore in this cluster, so reference the wildcard cert
   # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
   tls:
diff --git a/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml b/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
new file mode 100644
index 0000000..575b464
--- /dev/null
+++ b/manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: full-vmcp-ngorse-ingress
+  namespace: toolhive-system
+  labels:
+    app.kubernetes.io/name: full-vmcp
+  annotations:
+    dns.internal: 'true'
+    dns.internal.hostname: full-vmcp.ngorse.com
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`full-vmcp.ngorse.com`)
+      services:
+        - name: vmcp-full-vmcp
+          namespace: toolhive-system
+          port: 4483
+  # No default TLSStore in this cluster, so reference the wildcard cert
+  # explicitly. olb42-wildcard-tls is auto-reflected into every namespace.
+  tls:
+    secretName: ngorse-wildcard-tls
\ No newline at end of file