diff --git a/src/apps/apps.service.ts b/src/apps/apps.service.ts
index 12c83e3..8ed699c 100644
--- a/src/apps/apps.service.ts
+++ b/src/apps/apps.service.ts
@@ -999,6 +999,15 @@ export class AppsService {
             component: true,
           },
         },
+        ingressRules: {
+          include: {
+            component: true,
+          },
+          orderBy: [
+            { host: 'asc' },
+            { path: 'asc' },
+          ],
+        },
       },
     });
 
@@ -1086,6 +1095,42 @@ export class AppsService {
       }
     }
 
+    if (profile.ingressRules.length > 0) {
+      for (const rule of profile.ingressRules) {
+        const serviceName = sanitizeK8sName(rule.component.name);
+        const ingressName = sanitizeK8sName(`${rule.component.name}-${rule.host}-${rule.path}`);
+        const middlewareName = rule.stripPrefix ? sanitizeK8sName(`${ingressName}-strip`) : null;
+
+        if (middlewareName) {
+          logs.push(`[apply] middleware/${middlewareName}`);
+          appendOutput(
+            logs,
+            await this.applyK8sManifest(createTraefikStripPrefixMiddlewareManifest({
+              namespace,
+              name: middlewareName,
+              prefix: rule.path,
+            })),
+          );
+        }
+
+        logs.push(`[apply] ingress/${ingressName}`);
+        appendOutput(
+          logs,
+          await this.applyK8sManifest(createIngressManifest({
+            namespace,
+            name: ingressName,
+            host: rule.host,
+            path: rule.path,
+            serviceName,
+            servicePort: rule.servicePort,
+            middlewareName,
+            tlsEnabled: rule.tlsEnabled,
+            tlsSecretName: rule.tlsSecretName,
+          })),
+        );
+      }
+    }
+
     logs.push('[done] runtime profile applied');
     return { applied: true, logs: logs.filter(Boolean).join('\n') };
   }