diff --git a/k8s/bootstrap/ingress/nginx-values.yaml b/k8s/bootstrap/ingress/nginx-values.yaml
index 8872083..6f989ab 100644
--- a/k8s/bootstrap/ingress/nginx-values.yaml
+++ b/k8s/bootstrap/ingress/nginx-values.yaml
@@ -57,6 +57,16 @@ controller:
     keepalive-timeout: "65"
     keepalive-requests: "100"
 
+    # force-ssl-redirect: our Ingress objects intentionally omit per-rule `tls:`
+    # blocks (single wildcard cert served via default-ssl-certificate above).
+    # nginx-ingress's normal `ssl-redirect` only forces HTTPS for hosts that have
+    # an explicit TLS block on their own Ingress resource — since none of ours do,
+    # plain http://*.riotpiao.com requests were being served directly instead of
+    # 301-redirected to https://, silently serving every client-facing console
+    # over plaintext HTTP. force-ssl-redirect forces the redirect globally
+    # regardless of per-ingress TLS block presence.
+    force-ssl-redirect: "true"
+
   resources:
     requests:
       cpu: 50m