diff --git a/environment-provisioner/workflow-template.yaml b/environment-provisioner/workflow-template.yaml
index 1ef8e73..1b595f4 100644
--- a/environment-provisioner/workflow-template.yaml
+++ b/environment-provisioner/workflow-template.yaml
@@ -226,7 +226,7 @@ spec:
             original-owner: "$OWNER"
         EOF
 
-        # Create NetworkPolicy for isolation (allows ingress from same namespace, ingress-nginx, and argo-workflows)
+        # Create NetworkPolicy for isolation (allows ingress from same namespace, traefik, and argo-workflows)
         cat > manifests/networkpolicy.yaml <<EOF
         apiVersion: networking.k8s.io/v1
         kind: NetworkPolicy
@@ -245,7 +245,7 @@ spec:
           - from:
             - namespaceSelector:
                 matchLabels:
-                  kubernetes.io/metadata.name: ingress-nginx
+                  kubernetes.io/metadata.name: traefik
           - from:
             - namespaceSelector:
                 matchLabels:
@@ -347,35 +347,22 @@ spec:
               EDITED_CONTENT=$(echo "$VALUES_CONTENT_EDITS" | jq -r ".\"$service\" // empty")
               EXTRA_VALUES_FILES=""
 
+              # Build HTTPRoute hostname for this service
+              HTTPROUTE_HOST="${SANITIZED_SERVICE}-${NAMESPACE}.${INGRESS_DOMAIN}"
+              echo "  HTTPRoute hostname: $HTTPROUTE_HOST"
+
               if [ -n "$EDITED_CONTENT" ] && [ "$EDITED_CONTENT" != "null" ]; then
                 echo "  Writing edited values content to override file..."
                 VALUES_OVERRIDE_FILE="values-override-${SANITIZED_SERVICE}.yaml"
 
-                # Write ingress annotations + user edits to a single file
+                # Write user edits to override file (no ingress annotations needed with Gateway API)
                 cat > "manifests/$VALUES_OVERRIDE_FILE" <<OVERRIDE_EOF
-        ingress:
-          annotations:
-            nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-            nginx.ingress.kubernetes.io/ssl-redirect: "true"
-            cert-manager.io/cluster-issuer: letsencrypt-prod
         $EDITED_CONTENT
         OVERRIDE_EOF
 
                 echo "  Created: manifests/$VALUES_OVERRIDE_FILE"
                 EXTRA_VALUES_FILES="
                 - $VALUES_OVERRIDE_FILE"
-              else
-                # No user edits - still need ingress annotations in a separate file
-                INGRESS_FILE="ingress-annotations-${SANITIZED_SERVICE}.yaml"
-                cat > "manifests/$INGRESS_FILE" <<INGRESS_EOF
-        ingress:
-          annotations:
-            nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-            nginx.ingress.kubernetes.io/ssl-redirect: "true"
-            cert-manager.io/cluster-issuer: letsencrypt-prod
-        INGRESS_EOF
-                EXTRA_VALUES_FILES="
-                - $INGRESS_FILE"
               fi
 
               # Process external params for disabled Helm dependencies (e.g., external database config)
@@ -431,22 +418,20 @@ spec:
                 # Add podLabels for MySQL resources
                 - name: mysql.podLabels.backstage\.io/kubernetes-id
                   value: "$service"
-                # Enable ingress via Helm chart
+                # Disable traditional Ingress (using Gateway API HTTPRoute instead)
                 - name: ingress.enabled
+                  value: "false"
+                # Enable HTTPRoute (Gateway API)
+                - name: httpRoute.enabled
                   value: "true"
-                - name: ingress.className
-                  value: "nginx"
-                - name: ingress.hosts[0].host
-                  value: "${SANITIZED_SERVICE}-${NAMESPACE}.${INGRESS_DOMAIN}"
-                - name: ingress.hosts[0].paths[0].path
-                  value: "/"
-                - name: ingress.hosts[0].paths[0].pathType
-                  value: "Prefix"
-                # TLS Configuration for HTTPS
-                - name: ingress.tls[0].hosts[0]
-                  value: "${SANITIZED_SERVICE}-${NAMESPACE}.${INGRESS_DOMAIN}"
-                - name: ingress.tls[0].secretName
-                  value: "${SANITIZED_SERVICE}-${NAMESPACE}-tls"$DEPENDENCY_URL_PARAMS$CUSTOM_HELM_PARAMS
+                - name: httpRoute.parentRefs[0].name
+                  value: "main-gateway"
+                - name: httpRoute.parentRefs[0].namespace
+                  value: "traefik"
+                - name: httpRoute.parentRefs[0].sectionName
+                  value: "https"
+                - name: httpRoute.hostnames[0]
+                  value: "$HTTPROUTE_HOST"$DEPENDENCY_URL_PARAMS$CUSTOM_HELM_PARAMS
           destination:
             server: https://kubernetes.default.svc
             namespace: $NAMESPACE
@@ -458,7 +443,7 @@ spec:
               - CreateNamespace=false
               - ServerSideApply=true
         EOF
-            echo "  Ingress URL: https://${SANITIZED_SERVICE}-${NAMESPACE}.${INGRESS_DOMAIN}"
+            echo "  HTTPRoute URL: https://$HTTPROUTE_HOST"
             else
               # No Helm chart - create simple deployment manifest
               echo "Creating deployment manifest for service: $service"