diff --git a/kustomize/config/vcell-ai-rke-dev/litellm.env b/kustomize/config/vcell-ai-rke-dev/litellm.env
index 0fbb546..8919a2f 100644
--- a/kustomize/config/vcell-ai-rke-dev/litellm.env
+++ b/kustomize/config/vcell-ai-rke-dev/litellm.env
@@ -23,3 +23,13 @@ LANGFUSE_HOST=https://cloud.langfuse.com
 # rewrite-target and does NOT change route matching: the backend's in-cluster
 # calls to http://litellm:4000/v1/... keep working unprefixed.
 SERVER_ROOT_PATH=/kartik
+
+# Trust the ingress controller's X-Forwarded-Proto so generated URLs use https.
+# LiteLLM takes uvicorn's defaults, which install ProxyHeadersMiddleware but
+# only trust 127.0.0.1 (uvicorn/config.py: FORWARDED_ALLOW_IPS default). nginx
+# connects from a pod IP, so the header was ignored and /kartik/ui redirected to
+# an http:// URL. Browsers recovered via a second hop, but it was a plaintext
+# one. "*" is safe here because the Service is ClusterIP -- nothing outside the
+# cluster can reach the pod directly to forge the header, and nginx overwrites
+# it on every request.
+FORWARDED_ALLOW_IPS=*