diff --git a/apps/nginx-weighted/certificate.yaml b/apps/nginx-weighted/certificate.yaml
new file mode 100644
index 0000000..abb5694
--- /dev/null
+++ b/apps/nginx-weighted/certificate.yaml
@@ -0,0 +1,15 @@
+---
+# Certificate для nginx.thedevops.dev — запрашивается напрямую
+# т.к. IngressRoute не триггерит cert-manager автоматически через аннотации
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: nginx-weighted-tls
+  namespace: nginx-mcp
+spec:
+  secretName: nginx-weighted-tls
+  issuerRef:
+    name: letsencrypt-http
+    kind: ClusterIssuer
+  dnsNames:
+    - nginx.thedevops.dev