diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml
index 3e5e296..4e0aef8 100644
--- a/k8s/ingress.yaml
+++ b/k8s/ingress.yaml
@@ -25,10 +25,26 @@ metadata:
     cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   tls:
-    # Staging only, for now. Production hosts join this list at cutover (see header).
     - hosts:
         - bcs.int.7tl-homelab.com
       secretName: bcs-int-tls
+    # Production hostnames. This is the INTERNAL hop only: public traffic terminates TLS at the
+    # Pangolin VPS, which then proxies to these nodes over https:443 (the pattern every other
+    # k3s-backed Pangolin resource uses), so the cluster needs its own valid cert for these names.
+    #
+    # Safe to issue before cutover and deliberately done so: letsencrypt-prod solves DNS-01 via
+    # Cloudflare, which only needs a temporary TXT record in the zone — no A record has to point
+    # here, and the live WordPress site is unaffected. Pangolin's own edge cert is HTTP-01 and
+    # CANNOT be pre-issued; it is obtained on the first request after DNS moves. See
+    # docs/launch-checklist.md section 1.1.
+    #
+    # Both names are listed because the canonical-host decision (section 1.6) is still open;
+    # holding a cert for each keeps either choice available. The redirect is configured
+    # separately and does not depend on this.
+    - hosts:
+        - www.bluecapstrategies.com
+        - bluecapstrategies.com
+      secretName: bluecap-website-tls
   rules:
     - host: bcs.int.7tl-homelab.com
       http: