diff --git a/services/adguard/app.yaml b/services/adguard/app.yaml
index f66c456..6dfb443 100644
--- a/services/adguard/app.yaml
+++ b/services/adguard/app.yaml
@@ -85,6 +85,10 @@ kind: Ingress
 metadata:
   name: adguard
   namespace: adguard
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: adguard-lan-only@kubernetescrd
 spec:
   rules:
   - host: adguard.labzand.com
diff --git a/services/adguard/ingressroute-redirect.yaml b/services/adguard/ingressroute-redirect.yaml
new file mode 100644
index 0000000..609f88b
--- /dev/null
+++ b/services/adguard/ingressroute-redirect.yaml
@@ -0,0 +1,19 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor adguard.labzand.com.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-redirect
+  namespace: adguard
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`adguard.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService
diff --git a/services/adguard/middleware.yaml b/services/adguard/middleware.yaml
new file mode 100644
index 0000000..553d7f6
--- /dev/null
+++ b/services/adguard/middleware.yaml
@@ -0,0 +1,23 @@
+# Middlewares voor adguard.labzand.com (alleen intern):
+# - redirect-https: http (web) -> https
+# - lan-only: blokkeert verkeer van buiten het LAN op de websecure-router
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: adguard
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: lan-only
+  namespace: adguard
+spec:
+  ipAllowList:
+    sourceRange:
+      - 192.168.0.0/16
+      - 127.0.0.1/32
diff --git a/services/argocd/ingress.yaml b/services/argocd/ingress.yaml
index 90a68d9..3b109db 100644
--- a/services/argocd/ingress.yaml
+++ b/services/argocd/ingress.yaml
@@ -3,7 +3,12 @@ kind: Ingress
 metadata:
   name: argocd
   namespace: argocd
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: argocd-lan-only@kubernetescrd
 spec:
+  ingressClassName: traefik
   rules:
   - host: argocd.labzand.com
     http:
diff --git a/services/argocd/ingressroute-redirect.yaml b/services/argocd/ingressroute-redirect.yaml
new file mode 100644
index 0000000..64ca0b7
--- /dev/null
+++ b/services/argocd/ingressroute-redirect.yaml
@@ -0,0 +1,19 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor argocd.labzand.com.
+# services: api@internal is een dummy - de redirect middleware stuurt
+# nooit door naar een backend.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-redirect
+  namespace: argocd
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`argocd.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService
diff --git a/services/argocd/middleware.yaml b/services/argocd/middleware.yaml
new file mode 100644
index 0000000..f5a0486
--- /dev/null
+++ b/services/argocd/middleware.yaml
@@ -0,0 +1,23 @@
+# Middlewares voor argocd.labzand.com (alleen intern):
+# - redirect-https: http (web) -> https
+# - lan-only: blokkeert verkeer van buiten het LAN op de websecure-router
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: argocd
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: lan-only
+  namespace: argocd
+spec:
+  ipAllowList:
+    sourceRange:
+      - 192.168.0.0/16
+      - 127.0.0.1/32
diff --git a/services/authentik/ingress.yaml b/services/authentik/ingress.yaml
index 9d9264a..a9774f1 100644
--- a/services/authentik/ingress.yaml
+++ b/services/authentik/ingress.yaml
@@ -6,6 +6,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: authentik-lan-only@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/services/authentik/middleware-lan.yaml b/services/authentik/middleware-lan.yaml
new file mode 100644
index 0000000..cc995ed
--- /dev/null
+++ b/services/authentik/middleware-lan.yaml
@@ -0,0 +1,13 @@
+# Middleware voor auth.labzand.com (alleen intern): blokkeert verkeer
+# van buiten het LAN op de websecure-router.
+# (redirect-https staat in redirect.yaml)
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: lan-only
+  namespace: authentik
+spec:
+  ipAllowList:
+    sourceRange:
+      - 192.168.0.0/16
+      - 127.0.0.1/32
diff --git a/services/authentik/redirect.yaml b/services/authentik/redirect.yaml
new file mode 100644
index 0000000..14cec98
--- /dev/null
+++ b/services/authentik/redirect.yaml
@@ -0,0 +1,27 @@
+# HTTP (entrypoint web) -> HTTPS redirect voor auth.labzand.com.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: authentik
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: auth-redirect
+  namespace: authentik
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`auth.labzand.com`)
+      kind: Rule
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: api@internal
+          kind: TraefikService