diff --git a/ADDING-APPS.md b/ADDING-APPS.md
index 41f9b1d..04237f6 100644
--- a/ADDING-APPS.md
+++ b/ADDING-APPS.md
@@ -645,19 +645,47 @@ This means individual resources can use simple, component-specific selectors lik
 
 Resource files in this repository are **templates** that get compiled when users add apps via the web app, CLI, or API. Only variables defined in the manifest file's 'defaultConfig' section are available to the resource templates. Use gomplate syntax to reference configuration:
 
-### External DNS
+### Ingress
 
-Ingress resources should include external-dns annotations for automatic DNS management:
+Use this as the standard ingress template for all apps:
 
 ```yaml
-annotations:
-  external-dns.alpha.kubernetes.io/target: {{ .domain }}
-  external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: myapp
+  annotations:
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/ttl: "60"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: {{ .domain }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: myapp
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - {{ .domain }}
+    secretName: {{ .tlsSecretName }}
 ```
 
-Note: 'domain' must be defined in the app manifest's 'defaultConfig' section.
+**Rules:**
+- Always use `spec.ingressClassName: traefik` — do NOT use the `kubernetes.io/ingress.class` annotation (deprecated)
+- Do NOT add `cert-manager.io/cluster-issuer` — the wildcard TLS cert is pre-distributed to app namespaces and managed centrally; adding this annotation causes cert-manager to issue a wrong per-app cert that overwrites the wildcard secret
+- Do NOT add Traefik redirect annotations — HTTPS redirect is handled globally by Traefik
+- `externalDnsDomain`, `domain`, and `tlsSecretName` must be defined in `defaultConfig`
 
-This creates a CNAME from the app subdomain to the cluster domain (e.g., `myapp.cloud.example.com` → `cloud.example.com`).
+### External DNS
+
+The `external-dns.alpha.kubernetes.io/target` annotation creates a CNAME from the app subdomain to the cluster domain (e.g., `myapp.cloud.example.com` → `cloud.example.com`). Always set `cloudflare-proxied: "false"` since Wild Cloud manages its own TLS.
 
 ## App Dependencies and Reference Mapping
 
diff --git a/example-app/versions/1/ingress.yaml b/example-app/versions/1/ingress.yaml
index fdc253d..6a03c1a 100644
--- a/example-app/versions/1/ingress.yaml
+++ b/example-app/versions/1/ingress.yaml
@@ -5,15 +5,12 @@ metadata:
   name: example-app
   annotations:
     external-dns.alpha.kubernetes.io/target: "{{ .cloud.externalDnsTarget }}"
-    external-dns.alpha.kubernetes.io/cloudflare-proxied: false
-
-    # Optional: Enable HTTPS redirection
-    traefik.ingress.kubernetes.io/redirect-entry-point: https
-
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
     # Optional: Enable basic auth
     # traefik.ingress.kubernetes.io/auth-type: basic
     # traefik.ingress.kubernetes.io/auth-secret: basic-auth
 spec:
+  ingressClassName: traefik
   rules:
     - host: "{{ .host }}"
       http:
diff --git a/ghost/versions/5/ingress.yaml b/ghost/versions/5/ingress.yaml
index 02e7f96..ae480db 100644
--- a/ghost/versions/5/ingress.yaml
+++ b/ghost/versions/5/ingress.yaml
@@ -4,13 +4,11 @@ metadata:
   name: ghost
   namespace: ghost
   annotations:
-    kubernetes.io/ingress.class: "traefik"
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
     external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
     external-dns.alpha.kubernetes.io/ttl: "60"
-    traefik.ingress.kubernetes.io/redirect-entry-point: https
 spec:
+  ingressClassName: traefik
   rules:
     - host: {{ .domain }}
       http:
diff --git a/lemmy/versions/0/ingress.yaml b/lemmy/versions/0/ingress.yaml
index 9e19880..8e9ad1a 100644
--- a/lemmy/versions/0/ingress.yaml
+++ b/lemmy/versions/0/ingress.yaml
@@ -4,9 +4,6 @@ metadata:
   name: lemmy-ingress
   namespace: {{ .namespace }}
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
     external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec: