diff --git a/infrastructure/networking/traefik-helmchartconfig.yaml b/infrastructure/networking/traefik-helmchartconfig.yaml
new file mode 100644
index 0000000..501aea5
--- /dev/null
+++ b/infrastructure/networking/traefik-helmchartconfig.yaml
@@ -0,0 +1,45 @@
+---
+# k3s built-in Traefik HelmChartConfig overrides.
+#
+# k3s ships with a Traefik HelmChart; this HelmChartConfig layers extra
+# values on top without forking the chart. The helm-controller reconciles it
+# and rolls Traefik whenever this changes.
+#
+# Not managed by ArgoCD (ArgoCD doesn't manage kube-system in this cluster);
+# `kubectl apply -f infrastructure/networking/traefik-helmchartconfig.yaml`
+# is the reproducibility path if the cluster is rebuilt.
+#
+# Change history:
+# - DEV-455: badger plugin experimental + additionalArguments.
+# - DEV-457: enable providers.kubernetesCRD.allowCrossNamespace so Pangolin's
+#   TraefikService (ns=pangolin) can reference the paperclip Service (ns=paperclip).
+#   Add certResolver `letsencrypt` (HTTP-01) with persistent acme.json backing so
+#   Pangolin-generated IngressRoutes with `tls.certResolver=letsencrypt` load.
+#   podSecurityContext.fsGroup=65532 makes /data writable by Traefik's non-root UID.
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    experimental:
+      plugins:
+        badger:
+          moduleName: "github.com/fosrl/badger"
+          version: "v1.5.0"
+    persistence:
+      enabled: true
+      size: 128Mi
+      path: /data
+    podSecurityContext:
+      fsGroup: 65532
+      fsGroupChangePolicy: OnRootMismatch
+    additionalArguments:
+      - "--experimental.plugins.badger.moduleName=github.com/fosrl/badger"
+      - "--experimental.plugins.badger.version=v1.5.0"
+      - "--providers.kubernetescrd.allowCrossNamespace=true"
+      - "--certificatesresolvers.letsencrypt.acme.email=admin@basicstack.de"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"