diff --git a/environment-provisioner/workflow-template.yaml b/environment-provisioner/workflow-template.yaml
index 5ccae09..0cfce67 100644
--- a/environment-provisioner/workflow-template.yaml
+++ b/environment-provisioner/workflow-template.yaml
@@ -342,8 +342,18 @@ spec:
                 done
               fi
 
-              # Check for edited values content - write to override file if exists
-              INLINE_VALUES=""
+              # Initialize INLINE_VALUES with ingress annotations
+              # Dotted annotation keys (like nginx.ingress.kubernetes.io/ssl-redirect) must use
+              # the values block, not parameters. Helm's --set interprets dots as nested paths.
+              INLINE_VALUES="
+              values: |
+                ingress:
+                  annotations:
+                    nginx.ingress.kubernetes.io/force-ssl-redirect: \"true\"
+                    nginx.ingress.kubernetes.io/ssl-redirect: \"true\"
+                    cert-manager.io/cluster-issuer: letsencrypt-prod"
+
+              # Check for edited values content - merge with base annotations
               EDITED_CONTENT=$(echo "$VALUES_CONTENT_EDITS" | jq -r ".\"$service\" // empty")
               if [ -n "$EDITED_CONTENT" ] && [ "$EDITED_CONTENT" != "null" ]; then
                 echo "  Writing edited values content to override file..."
@@ -351,10 +361,15 @@ spec:
                 VALUES_OVERRIDE_FILE="values-override-${SANITIZED_SERVICE}.yaml"
                 echo "$EDITED_CONTENT" > "manifests/$VALUES_OVERRIDE_FILE"
                 echo "  Created: manifests/$VALUES_OVERRIDE_FILE"
-                # Set inline values for ArgoCD - indent the content properly
+                # Set inline values for ArgoCD - merge user edits with base ingress annotations
                 INDENTED_CONTENT=$(echo "$EDITED_CONTENT" | sed 's/^/                /')
                 INLINE_VALUES="
               values: |
+                ingress:
+                  annotations:
+                    nginx.ingress.kubernetes.io/force-ssl-redirect: \"true\"
+                    nginx.ingress.kubernetes.io/ssl-redirect: \"true\"
+                    cert-manager.io/cluster-issuer: letsencrypt-prod
         $INDENTED_CONTENT"
               fi
 
@@ -424,14 +439,7 @@ spec:
                 - name: ingress.tls[0].hosts[0]
                   value: "${SANITIZED_SERVICE}-${NAMESPACE}.${INGRESS_DOMAIN}"
                 - name: ingress.tls[0].secretName
-                  value: "${SANITIZED_SERVICE}-${NAMESPACE}-tls"
-                # Annotations for cert-manager and HTTPS
-                - name: ingress.annotations.nginx\.ingress\.kubernetes\.io/force-ssl-redirect
-                  value: '"true"'
-                - name: ingress.annotations.nginx\.ingress\.kubernetes\.io/ssl-redirect
-                  value: '"true"'
-                - name: ingress.annotations.cert-manager\.io/cluster-issuer
-                  value: letsencrypt-prod$DEPENDENCY_URL_PARAMS$CUSTOM_HELM_PARAMS
+                  value: "${SANITIZED_SERVICE}-${NAMESPACE}-tls"$DEPENDENCY_URL_PARAMS$CUSTOM_HELM_PARAMS
           destination:
             server: https://kubernetes.default.svc
             namespace: $NAMESPACE