diff --git a/k8s/06-ingress.yaml b/k8s/06-ingress.yaml
index 882a489..94f06eb 100644
--- a/k8s/06-ingress.yaml
+++ b/k8s/06-ingress.yaml
@@ -7,6 +7,11 @@ metadata:
   namespace: artista
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    # Challenge-Pfad direkt in DIESEN Ingress eintragen statt in einen
+    # eigenen ohne TLS: sonst leitet die HTTP->HTTPS-Umleitung die
+    # Let's-Encrypt-Pruefung auf HTTPS um, wo nur die App antwortet
+    # ("expected <token> but got <!doctype html>").
+    acme.cert-manager.io/http01-edit-in-place: "true"
     # HTTP -> HTTPS ueber die Middleware unten (Praefix = Namespace).
     traefik.ingress.kubernetes.io/router.middlewares: artista-redirect-to-https@kubernetescrd
 spec: