diff --git a/k8s/05-ingress.yaml b/k8s/05-ingress.yaml
index 53ba72b..c0cacc1 100644
--- a/k8s/05-ingress.yaml
+++ b/k8s/05-ingress.yaml
@@ -1,4 +1,5 @@
-# ANPASSEN: Domain (2x, auch APP_URL in 01-config.yaml), ClusterIssuer.
+# Ingress fuer Traefik + cert-manager (gleiches Muster wie Wabenhain).
+# ANPASSEN: Domain (2x, auch APP_URL in 01-config.yaml).
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -6,6 +7,8 @@ metadata:
   namespace: artista
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    # HTTP -> HTTPS ueber die Middleware unten (Praefix = Namespace).
+    traefik.ingress.kubernetes.io/router.middlewares: artista-redirect-to-https@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:
@@ -21,4 +24,14 @@ spec:
               service:
                 name: artista-modelcamp-app
                 port:
-                  name: http
+                  number: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-to-https
+  namespace: artista
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
diff --git a/k8s/07-networkpolicy.yaml b/k8s/07-networkpolicy.yaml
index 62667ff..f60181a 100644
--- a/k8s/07-networkpolicy.yaml
+++ b/k8s/07-networkpolicy.yaml
@@ -1,5 +1,7 @@
 # Datenbank nur fuer App und Worker erreichbar; App nur ueber Traefik.
-# ANPASSEN: Namespace deines Traefik ("kubectl get pods -A | grep traefik").
+# Traefik wird am Pod-Label erkannt, egal in welchem Namespace es laeuft
+# (eigene Installation "traefik" oder RKE2-Paket "rke2-traefik").
+# Pruefen: kubectl get pods -A -l 'app.kubernetes.io/name in (traefik,rke2-traefik)'
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -28,8 +30,11 @@ spec:
       app: artista-modelcamp-app
   ingress:
     - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
+        - namespaceSelector: {}
+          podSelector:
+            matchExpressions:
+              - key: app.kubernetes.io/name
+                operator: In
+                values: [traefik, rke2-traefik]
       ports:
         - port: 3000