diff --git a/tmpl/cluster/flux-system/webhooks/github/ingress.yaml b/tmpl/cluster/flux-system/webhooks/github/ingress.yaml
index f0690cfd..536b7212 100644
--- a/tmpl/cluster/flux-system/webhooks/github/ingress.yaml
+++ b/tmpl/cluster/flux-system/webhooks/github/ingress.yaml
@@ -8,6 +8,7 @@ metadata:
     cert-manager.io/cluster-issuer: "letsencrypt-production"
     external-dns/is-public: "true"
     external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
+    traefik.ingress.kubernetes.io/router.middlewares: "networking-cloudflare-only@kubernetescrd"
 spec:
   ingressClassName: traefik
   rules: