diff --git a/k8s/infra/controllers/argocd/http-route.yaml b/k8s/infra/controllers/argocd/http-route.yaml
index 2ca528c..3a00cef 100644
--- a/k8s/infra/controllers/argocd/http-route.yaml
+++ b/k8s/infra/controllers/argocd/http-route.yaml
@@ -16,4 +16,11 @@ spec:
             value: /
       backendRefs:
         - name: argocd-server
-          port: 80
\ No newline at end of file
+          port: 80
+#    - matches:
+#        - headers:
+#            - name: Content-Type
+#              value: application/grpc
+#      backendRefs:
+#        - name: argocd-server
+#          port: 80
diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml
index a6483a3..803b4e4 100644
--- a/k8s/infra/controllers/argocd/kustomization.yaml
+++ b/k8s/infra/controllers/argocd/kustomization.yaml
@@ -3,7 +3,8 @@ kind: Kustomization
 
 resources:
   - ns.yaml
-  - http-route.yaml
+#  - http-route.yaml
+  - tls-route.yaml
   - oidc.yaml
 
 helmCharts:
diff --git a/k8s/infra/controllers/argocd/tls-route.yaml b/k8s/infra/controllers/argocd/tls-route.yaml
new file mode 100644
index 0000000..08a8ac0
--- /dev/null
+++ b/k8s/infra/controllers/argocd/tls-route.yaml
@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - name: internal
+      namespace: gateway
+  hostnames:
+    - "argocd.stonegarden.dev"
+  rules:
+    - backendRefs:
+        - name: argocd-server
+          port: 443
diff --git a/k8s/infra/controllers/argocd/values.yaml b/k8s/infra/controllers/argocd/values.yaml
index 752a166..6cc6a4e 100644
--- a/k8s/infra/controllers/argocd/values.yaml
+++ b/k8s/infra/controllers/argocd/values.yaml
@@ -32,7 +32,7 @@ configs:
           args: [ kustomize build --enable-helm ]
   params:
     controller.diff.server.side: true
-    server.insecure: true
+    server.insecure: false
   rbac:
     scopes: '[ argocd_claim ]'
     policy.csv: |
@@ -76,6 +76,18 @@ server:
       memory: 64Mi
     limits:
       memory: 1Gi
+  certificate:
+    enabled: true
+    domain: argocd.stonegarden.dev
+    issuer:
+      group: cert-manager.io
+      kind: ClusterIssuer
+      name: cloudflare-cluster-issuer
+    privateKey:
+      algorithm: ECDSA
+      size: 256
+  service:
+    servicePortHttpsAppProtocol: kubernetes.io/h2c
 
 repoServer:
   containerSecurityContext:
diff --git a/k8s/infra/network/cilium/values.yaml b/k8s/infra/network/cilium/values.yaml
index 72d855f..bb1c67a 100644
--- a/k8s/infra/network/cilium/values.yaml
+++ b/k8s/infra/network/cilium/values.yaml
@@ -70,6 +70,8 @@ loadBalancer:
 
 gatewayAPI:
   enabled: true
+  enableAlpn: true
+  enableAppProtocol: true
 envoy:
   securityContext:
     capabilities:
diff --git a/k8s/infra/network/gateway/gw-internal.yaml b/k8s/infra/network/gateway/gw-internal.yaml
index b9a862c..342d356 100644
--- a/k8s/infra/network/gateway/gw-internal.yaml
+++ b/k8s/infra/network/gateway/gw-internal.yaml
@@ -9,6 +9,15 @@ spec:
     - type: IPAddress
       value: 192.168.1.220
   listeners:
+    - protocol: TLS
+      port: 443
+      name: tls-passthrough
+      hostname: "*.stonegarden.dev"
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
     - protocol: HTTPS
       port: 443
       name: https-gateway