diff --git a/ansible-5/roles/prod.k3s/files/gitea/values.yaml b/ansible-5/roles/prod.k3s/files/gitea/values.yaml
index 16a51cd..286a498 100644
--- a/ansible-5/roles/prod.k3s/files/gitea/values.yaml
+++ b/ansible-5/roles/prod.k3s/files/gitea/values.yaml
@@ -23,6 +23,9 @@ ingress:
       paths:
         - path: /
           pathType: Prefix
+  tls: # < placing a host in the TLS config will determine what ends up in the cert's subjectAltNames
+    - secretName: xai-corp-production-tls
+
 persistence:
   enabled: true
 
diff --git a/ansible-5/roles/prod.k3s/files/stash/values.yaml b/ansible-5/roles/prod.k3s/files/stash/values.yaml
index 9e9acd0..2abc6fa 100644
--- a/ansible-5/roles/prod.k3s/files/stash/values.yaml
+++ b/ansible-5/roles/prod.k3s/files/stash/values.yaml
@@ -4,7 +4,7 @@
 
 image:
   repository: stashapp/stash
-  tag: v0.17.2
+  tag: v0.18.0
 
 ingress:
   main:
@@ -13,6 +13,9 @@ ingress:
       - host: stash.xai-corp.net
         paths:
           - path: /
+    tls: # < placing a host in the TLS config will determine what ends up in the cert's subjectAltNames
+      - secretName: xai-corp-production-tls
+
 persistence:
   config:
     enabled: true