diff --git a/platform/argocd-ingress.yaml b/platform/argocd-ingress.yaml
new file mode 100644
index 0000000..8a6186e
--- /dev/null
+++ b/platform/argocd-ingress.yaml
@@ -0,0 +1,25 @@
+# Exposição do ArgoCD via Traefik com TLS (Let's Encrypt)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - argocd.athleticmap.influxdigital.com.br
+      secretName: argocd-tls
+  rules:
+    - host: argocd.athleticmap.influxdigital.com.br
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80
diff --git a/tenants/demo/20-keycloak.yaml b/tenants/demo/20-keycloak.yaml
index c94a7c0..4d961e2 100644
--- a/tenants/demo/20-keycloak.yaml
+++ b/tenants/demo/20-keycloak.yaml
@@ -46,7 +46,7 @@ spec:
             - name: KC_HOSTNAME
               value: "auth-demo.athleticmap.influxdigital.com.br"
             - name: KC_HOSTNAME_STRICT
-              value: "false"
+              value: "true"
           ports:
             - containerPort: 8080
             - containerPort: 9000
diff --git a/tenants/piloto/20-keycloak.yaml b/tenants/piloto/20-keycloak.yaml
index bdac216..4a19958 100644
--- a/tenants/piloto/20-keycloak.yaml
+++ b/tenants/piloto/20-keycloak.yaml
@@ -46,7 +46,7 @@ spec:
             - name: KC_HOSTNAME
               value: "auth-piloto.athleticmap.influxdigital.com.br"
             - name: KC_HOSTNAME_STRICT
-              value: "false"
+              value: "true"
           ports:
             - containerPort: 8080
             - containerPort: 9000