diff --git a/tenants/plataforma/30-ingress.yaml b/tenants/plataforma/30-ingress.yaml
index 0ec36d6..9d7df84 100644
--- a/tenants/plataforma/30-ingress.yaml
+++ b/tenants/plataforma/30-ingress.yaml
@@ -131,9 +131,6 @@ spec:
           - { path: /api/public/webhooks/asaas, pathType: Prefix, backend: { service: { name: servico-financeiro, port: { number: 80 } } } }
 
           # O resto exige token, como em qualquer tenant.
-          - { path: /api/configuracao, pathType: Prefix, backend: { service: { name: servico-configuracao, port: { number: 80 } } } }
-          - { path: /api/cadastro,     pathType: Prefix, backend: { service: { name: servico-cadastro,     port: { number: 80 } } } }
-          - { path: /api/financeiro,   pathType: Prefix, backend: { service: { name: servico-financeiro,   port: { number: 80 } } } }
           - { path: /bff,              pathType: Prefix, backend: { service: { name: servico-bff,          port: { number: 80 } } } }
           - { path: /,                 pathType: Prefix, backend: { service: { name: frontend-spa,         port: { number: 80 } } } }
 
diff --git a/tenants/plataforma/31-ingress-api-fechada.yaml b/tenants/plataforma/31-ingress-api-fechada.yaml
new file mode 100644
index 0000000..7b4049a
--- /dev/null
+++ b/tenants/plataforma/31-ingress-api-fechada.yaml
@@ -0,0 +1,46 @@
+# 05/10/2026: as rotas INTERNAS dos servicos nao ficam na internet. O que a plataforma expoe e o BFF (/bff), o
+# captacao (/api/public/*, /api/cliente, /api/plataforma/painel) e o webhook do Asaas (/api/public/webhooks/asaas).
+# Antes, /api/configuracao, /api/cadastro e /api/financeiro iam direto aos servicos pelo Ingress principal, e o
+# nginx antigo do frontend-spa da plataforma (2.85) repassa TODOS os /api/<contexto> — por isso o bloqueio e aqui,
+# na borda: prefixo mais longo vence o "/" do frontend, e o middleware recusa qualquer origem (403).
+# Quem precisa falar com esses servicos usa o Service interno (CronJobs) ou  (scripts de teste).
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: negar-api-interna
+  namespace: plataforma-prod
+spec:
+  ipAllowList:
+    sourceRange: ["127.0.0.1/32"]
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: plataforma-api-fechada
+  namespace: plataforma-prod
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: plataforma-prod-redirect-https@kubernetescrd,plataforma-prod-negar-api-interna@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [plataforma.athleticmap.com]
+      secretName: plataforma-tls
+  rules:
+    - host: plataforma.athleticmap.com
+      http:
+        paths:
+          - { path: /api/configuracao, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/cadastro, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/organizacao, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/documentos, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/agenda, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/retencao, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/planejamento, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/campeonato, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/administrativo, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/financeiro, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/saude, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/nutricao, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/assistencia-social, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
+          - { path: /api/pedagogico, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }