diff --git a/k8s-ng/core-state/values.yaml b/k8s-ng/core-state/values.yaml
index 03dfc16..6f96541 100644
--- a/k8s-ng/core-state/values.yaml
+++ b/k8s-ng/core-state/values.yaml
@@ -20,6 +20,10 @@ apps:
     path: k8s-ng/core/cnpg
     namespace: cnpg-system
     wave: 1
+  - name: traefik-config
+    path: k8s-ng/core/traefik-config
+    namespace: kube-system
+    wave: 1
   - name: cert-manager
     path: k8s-ng/core/cert-manager
     namespace: cert-manager
diff --git a/k8s-ng/core/traefik-config/helmchartconfig.yaml b/k8s-ng/core/traefik-config/helmchartconfig.yaml
new file mode 100644
index 0000000..64947aa
--- /dev/null
+++ b/k8s-ng/core/traefik-config/helmchartconfig.yaml
@@ -0,0 +1,16 @@
+# Configuration of the Traefik that ships with k3s.
+# Ingresses without a router.entrypoints annotation now use only "websecure", so
+# plain HTTP is redirected to HTTPS by default (see http-redirect.yaml).
+# To publish an Ingress over plain HTTP add the annotation
+#   traefik.ingress.kubernetes.io/router.entrypoints: web
+# (or "web,websecure" to serve both without a redirect).
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    ports:
+      websecure:
+        asDefault: true
diff --git a/k8s-ng/core/traefik-config/http-redirect.yaml b/k8s-ng/core/traefik-config/http-redirect.yaml
new file mode 100644
index 0000000..f814e06
--- /dev/null
+++ b/k8s-ng/core/traefik-config/http-redirect.yaml
@@ -0,0 +1,29 @@
+# Catch-all on the "web" entrypoint with the lowest priority: every host that has
+# no explicit HTTP router of its own is redirected to HTTPS.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: kube-system
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: http-redirect
+  namespace: kube-system
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: HostRegexp(`.+`)
+      kind: Rule
+      priority: 1
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: noop@internal
+          kind: TraefikService
diff --git a/k8s-ng/core/traefik-config/kustomization.yaml b/k8s-ng/core/traefik-config/kustomization.yaml
new file mode 100644
index 0000000..593246c
--- /dev/null
+++ b/k8s-ng/core/traefik-config/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - helmchartconfig.yaml
+  - http-redirect.yaml