diff --git a/core/ingress.tf b/core/ingress.tf
index 54f6187..a313a75 100644
--- a/core/ingress.tf
+++ b/core/ingress.tf
@@ -53,7 +53,7 @@ resource "kubernetes_manifest" "letsencrypt_prod" {
     }
     "spec" = {
       "acme" = {
-        "email"               = "franckrobbin6@gmail.com"
+        "email" = "franckrobbin6@gmail.com"
         "privateKeySecretRef" = {
           "name" = "letsencrypt-prod-account-key"
         }
diff --git a/core/services.tf b/core/services.tf
index c587407..800648b 100644
--- a/core/services.tf
+++ b/core/services.tf
@@ -3,10 +3,21 @@ resource "kubernetes_ingress_v1" "automatic_ingress" {
   metadata {
     name      = "${each.key}-ingress"
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    annotations = {
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+    }
   }
 
   spec {
     ingress_class_name = "traefik"
+    # Dynamic TLS configuration for cert-manager
+    tls {
+      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
+      secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
+    }
+
     rule {
       host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
       http {
diff --git a/core/variables.auto.tfvars b/core/variables.auto.tfvars
index c64e50f..1bcee97 100644
--- a/core/variables.auto.tfvars
+++ b/core/variables.auto.tfvars
@@ -139,7 +139,7 @@ kubernetes = {
     replicas       = 1
     name           = "bitwarden-admin"
     image          = "ghcr.io/bitwarden/admin:2026.1.0"
-    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml"]
+    extra_manifest = ["../external_manifests/bitwarden/config.configmap.yml", "../external_manifests/bitwarden/global.env.configmap.yml", "../external_manifests/bitwarden/global.override.env.configmap.yml", "../external_manifests/bitwarden/mssql.env.configmap.yml", "../external_manifests/bitwarden/mssql.override.env.configmap.yml", "../external_manifests/bitwarden/uid.env.configmap.yml", "../external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml"]
     service_port   = [5000]
     exposed        = false
     config_map_ref = ["global.env", "uid.env", "global.override.env"]