diff --git a/deploy/k8s/backend/ingress.yaml b/deploy/k8s/backend/ingress.yaml
index ca1e39d..4687776 100644
--- a/deploy/k8s/backend/ingress.yaml
+++ b/deploy/k8s/backend/ingress.yaml
@@ -6,6 +6,10 @@ metadata:
     # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
     # (or swap for whatever issuer/cert mechanism the cluster already uses).
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo
+    # rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor
+    # Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen.
+    traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd
 spec:
   ingressClassName: nginx
   tls:
diff --git a/deploy/k8s/frontend/ingress.yaml b/deploy/k8s/frontend/ingress.yaml
index 08a91b9..a5e5755 100644
--- a/deploy/k8s/frontend/ingress.yaml
+++ b/deploy/k8s/frontend/ingress.yaml
@@ -6,6 +6,10 @@ metadata:
     # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
     # (or swap for whatever issuer/cert mechanism the cluster already uses).
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo
+    # rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor
+    # Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen.
+    traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd
 spec:
   ingressClassName: nginx
   tls: