diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml
index 44bb9f1..3e5e296 100644
--- a/k8s/ingress.yaml
+++ b/k8s/ingress.yaml
@@ -1,3 +1,20 @@
+# Two audiences, deliberately separated:
+#
+#   1. bcs.int.7tl-homelab.com  — STAGING. LAN-only (*.int resolves to the internal traefik LB at
+#      10.66.15.30) with a real Let's Encrypt cert. This is how the rebuild is reviewed before
+#      launch. Safe: it is not reachable from the internet and does not touch the real domain.
+#
+#   2. www.bluecapstrategies.com / bluecapstrategies.com — PRODUCTION. Listed as routes so the
+#      cluster is ready, but deliberately NOT in the tls block yet: the live WordPress site still
+#      serves these names and must keep doing so until cutover. Requesting a cert for them is a
+#      launch step, not a prerequisite.
+#
+# TLS: ClusterIssuer is `letsencrypt-prod` (NOTE: not "letsencrypt-production" — an earlier comment
+# here had the name wrong). It solves via DNS-01 against Cloudflare, which means a cert can be
+# issued BEFORE any DNS points at this cluster. At cutover, add the two production hosts to the
+# tls block and let the cert issue first, then move DNS — no insecure window, no HTTP-01
+# chicken-and-egg. That requires bluecapstrategies.com to be in the Cloudflare account the
+# cert-manager API token can reach; verify that before relying on it.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -5,16 +22,24 @@ metadata:
   namespace: bluecap-strategies
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    # If cert-manager is installed, uncomment and set your ClusterIssuer.
-    # cert-manager.io/cluster-issuer: letsencrypt-production
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
-  # If cert-manager is installed, uncomment tls and set the secret name.
-  # tls:
-  #   - hosts:
-  #       - www.bluecapstrategies.com
-  #       - bluecapstrategies.com
-  #     secretName: bluecap-website-tls
+  tls:
+    # Staging only, for now. Production hosts join this list at cutover (see header).
+    - hosts:
+        - bcs.int.7tl-homelab.com
+      secretName: bcs-int-tls
   rules:
+    - host: bcs.int.7tl-homelab.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: bluecap-website
+                port:
+                  name: http
     - host: www.bluecapstrategies.com
       http:
         paths: