diff --git a/.k8s/production/ingress.yaml b/.k8s/production/ingress.yaml
index 8bddaa787c21..4d55508689d2 100644
--- a/.k8s/production/ingress.yaml
+++ b/.k8s/production/ingress.yaml
@@ -2,8 +2,16 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: graph-docs
+  annotations:
+    cert-manager.io/issuer: "prod-cluster-origin-issuer"
+    cert-manager.io/issuer-kind: "ClusterOriginIssuer"
+    cert-manager.io/issuer-group: "cert-manager.k8s.cloudflare.com"
 spec:
   ingressClassName: nginx
+  tls:
+    - hosts:
+        - thegraph.com
+      secretName: thegraph-com-tls
   rules:
     - host: thegraph.com
       http:
diff --git a/.k8s/staging/ingress.yaml b/.k8s/staging/ingress.yaml
index f04f058efb01..b1f6a2a486b7 100644
--- a/.k8s/staging/ingress.yaml
+++ b/.k8s/staging/ingress.yaml
@@ -2,8 +2,16 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: graph-docs
+  annotations:
+    cert-manager.io/issuer: "staging-cluster-origin-issuer"
+    cert-manager.io/issuer-kind: "ClusterOriginIssuer"
+    cert-manager.io/issuer-group: "cert-manager.k8s.cloudflare.com"
 spec:
   ingressClassName: nginx
+  tls:
+    - hosts:
+        - staging.thegraph.com
+      secretName: staging-thegraph-com-tls
   rules:
     - host: staging.thegraph.com
       http: