diff --git a/apps/base/haproxy/backendtlspolicy.yaml b/apps/base/haproxy/backendtlspolicy.yaml
new file mode 100644
index 0000000..0260b30
--- /dev/null
+++ b/apps/base/haproxy/backendtlspolicy.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: haproxy
+  namespace: haproxy
+  labels:
+    app: haproxy
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: haproxy
+  validation:
+    wellKnownCACertificates: System
+    hostname: git.unkin.net
diff --git a/apps/base/haproxy/gateway.yaml b/apps/base/haproxy/gateway.yaml
index 19591d4..aeb0fb1 100644
--- a/apps/base/haproxy/gateway.yaml
+++ b/apps/base/haproxy/gateway.yaml
@@ -1,10 +1,8 @@
 ---
 # External (DMZ) front for the haproxy edge on the traefik-external LB VIP
-# 198.18.199.0. The :443 listener is TLS Passthrough: haproxy owns the three
-# wildcard certs and terminates behind Traefik, so there are no certificateRefs
-# here. Listener hostnames are deliberately unset and the routes carry the
-# explicit hostname list instead; allowedRoutes Same keeps other namespaces off
-# these listeners.
+# 198.18.199.0. Traefik terminates TLS so HTTP/2 connections coalesced from
+# other *.unkin.net hosts still route by Host; the hop to haproxy is re-encrypted via
+# BackendTLSPolicy. Routes carry the explicit hostname list.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -21,11 +19,21 @@ spec:
       allowedRoutes:
         namespaces:
           from: Same
-    - name: https-passthrough
+    - name: https
       port: 443
-      protocol: TLS
+      protocol: HTTPS
       tls:
-        mode: Passthrough
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: wildcard-unkin-net-tls
+          - group: ""
+            kind: Secret
+            name: wildcard-main-unkin-net-tls
+          - group: ""
+            kind: Secret
+            name: wildcard-ceph-unkin-net-tls
       allowedRoutes:
         namespaces:
           from: Same
diff --git a/apps/base/haproxy/httproute.yaml b/apps/base/haproxy/httproute.yaml
index 9ca1411..2688a64 100644
--- a/apps/base/haproxy/httproute.yaml
+++ b/apps/base/haproxy/httproute.yaml
@@ -34,3 +34,36 @@ spec:
         - path:
             type: PathPrefix
             value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: haproxy
+  namespace: haproxy
+  labels:
+    app: haproxy
+spec:
+  hostnames:
+    - sonarr.main.unkin.net
+    - radarr.main.unkin.net
+    - lidarr.main.unkin.net
+    - readarr.main.unkin.net
+    - prowlarr.main.unkin.net
+    - nzbget.main.unkin.net
+    - jellyfin.main.unkin.net
+    - fafflix.unkin.net
+    - git.unkin.net
+    - dashboard.ceph.unkin.net
+    - auth.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: haproxy
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: haproxy
+          port: 443
+          weight: 1
diff --git a/apps/base/haproxy/kustomization.yaml b/apps/base/haproxy/kustomization.yaml
index 16f50f5..35c5cc0 100644
--- a/apps/base/haproxy/kustomization.yaml
+++ b/apps/base/haproxy/kustomization.yaml
@@ -8,7 +8,7 @@ resources:
   - deployment.yaml
   - service.yaml
   - gateway.yaml
-  - tlsroute.yaml
+  - backendtlspolicy.yaml
   - httproute.yaml
   - pdb.yaml
   - vpa.yaml
diff --git a/apps/base/haproxy/service.yaml b/apps/base/haproxy/service.yaml
index d98b2d7..13cd587 100644
--- a/apps/base/haproxy/service.yaml
+++ b/apps/base/haproxy/service.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: haproxy
 spec:
   type: ClusterIP
-  # Reached only by the external Traefik's TLS-passthrough TLSRoute, so the
+  # Reached only by the external Traefik (re-encrypted HTTPRoute), so the
   # peer address here is a Traefik pod, not the client. sessionAffinity is
   # deliberately absent: keyed on ClientIP it would pin whole Traefik pods,
   # not clients. Backend persistence rests on the per-backend SRVNAME cookie.
diff --git a/apps/base/haproxy/tlsroute.yaml b/apps/base/haproxy/tlsroute.yaml
deleted file mode 100644
index 1a2c37c..0000000
--- a/apps/base/haproxy/tlsroute.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TLSRoute
-metadata:
-  name: haproxy
-  namespace: haproxy
-  labels:
-    app: haproxy
-spec:
-  hostnames:
-    - sonarr.main.unkin.net
-    - radarr.main.unkin.net
-    - lidarr.main.unkin.net
-    - readarr.main.unkin.net
-    - prowlarr.main.unkin.net
-    - nzbget.main.unkin.net
-    - jellyfin.main.unkin.net
-    - fafflix.unkin.net
-    - git.unkin.net
-    - dashboard.ceph.unkin.net
-    - auth.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: haproxy
-      sectionName: https-passthrough
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: haproxy
-          port: 443
-          weight: 1