diff --git a/clusters/cl01tl/applications/penpot/values.yaml b/clusters/cl01tl/applications/penpot/values.yaml
index 226ad97db..8043f5dc5 100644
--- a/clusters/cl01tl/applications/penpot/values.yaml
+++ b/clusters/cl01tl/applications/penpot/values.yaml
@@ -55,7 +55,7 @@ penpot:
             - name: PENPOT_STORAGE_ASSETS_S3_BUCKET
               value: penpot
             - name: PENPOT_STORAGE_ASSETS_S3_ENDPOINT
-              value: http://minio.penpot:80/penpot
+              value: https://minio-penpot-api.alexlebens.net/penpot
             - name: PENPOT_TELEMETRY_ENABLED
               value: false
             - name: PENPOT_OIDC_BASE_URI
@@ -131,7 +131,7 @@ penpot:
             - name: PENPOT_STORAGE_ASSETS_S3_BUCKET
               value: penpot
             - name: PENPOT_STORAGE_ASSETS_S3_ENDPOINT
-              value: http://minio.penpot:80/penpot
+              value: https://minio-penpot-api.alexlebens.net/penpot
             - name: PENPOT_TELEMETRY_ENABLED
               value: false
             - name: PENPOT_OIDC_BASE_URI
@@ -215,7 +215,7 @@ penpot:
             - name: PENPOT_STORAGE_ASSETS_S3_BUCKET
               value: penpot
             - name: PENPOT_STORAGE_ASSETS_S3_ENDPOINT
-              value: http://minio.penpot:80/penpot
+              value: https://minio-penpot-api.alexlebens.net/penpot
             - name: PENPOT_TELEMETRY_ENABLED
               value: false
             - name: PENPOT_OIDC_BASE_URI
@@ -352,6 +352,20 @@ minio:
     certificate:
       requestAutoCert: false
   ingress:
+    api:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+        cert-manager.io/cluster-issuer: letsencrypt-issuer
+      tls:
+        - secretName: minio-penpot-api-secret-tls
+          hosts:
+            - minio-penpot-api.alexlebens.net
+      host: minio-penpot-api.alexlebens.net
+      path: /
+      pathType: Prefix
     console:
       enabled: true
       ingressClassName: traefik