diff --git a/clusters/noble/bootstrap/headlamp/values.yaml b/clusters/noble/bootstrap/headlamp/values.yaml
index e653fc8..208f062 100644
--- a/clusters/noble/bootstrap/headlamp/values.yaml
+++ b/clusters/noble/bootstrap/headlamp/values.yaml
@@ -27,7 +27,8 @@ ingress:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     # Headlamp OIDC behind Traefik: ensure external TLS scheme reaches the app (see middleware-https-proto.yaml).
-    traefik.ingress.kubernetes.io/router.middlewares: headlamp-https-proto@kubernetescrd
+    # Traefik Ingress refs CRD middlewares as <k8s-namespace>-<middleware-metadata.name>@kubernetescrd (see Traefik docs).
+    traefik.ingress.kubernetes.io/router.middlewares: headlamp-headlamp-https-proto@kubernetescrd
   hosts:
     - host: headlamp.apps.noble.lab.pcenicni.dev
       paths: