diff --git a/keycloak/keycloak.yaml b/keycloak/keycloak.yaml
index 350681f..8e6a1a3 100644
--- a/keycloak/keycloak.yaml
+++ b/keycloak/keycloak.yaml
@@ -17,5 +17,9 @@ spec:
     tlsSecret: keycloak-tls-secret
   hostname:
     hostname: keycloak.grxe.io
+  ingress:
+    annotations: cert-manager.io/cluster-issuer: letsencrypt-prod
+    enabled: true
+    tlsSecret: keycloak-tls-secret
   proxy:
     headers: xforwarded # double check your reverse proxy sets and overwrites the X-Forwarded-* headers