diff --git a/apps/forgejo/app/route.yaml b/apps/forgejo/app/route.yaml
index a89a9ad..2606722 100644
--- a/apps/forgejo/app/route.yaml
+++ b/apps/forgejo/app/route.yaml
@@ -9,9 +9,12 @@ spec:
   routes:
   - match: Host(`git.trivernis.dev`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: forgejo-http
-      port: 3000
+      port: http
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRouteTCP
@@ -25,4 +28,4 @@ spec:
   - match: HostSNI(`*`)
     services:
     - name: forgejo-ssh
-      port: 22
+      port: ssh
diff --git a/apps/longhorn/app/route.yaml b/apps/longhorn/app/route.yaml
index c9ef2d6..1cb3a2d 100644
--- a/apps/longhorn/app/route.yaml
+++ b/apps/longhorn/app/route.yaml
@@ -18,8 +18,11 @@ spec:
   routes:
   - match: Host(`longhorn.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: longhorn-frontend
-      port: 80
+      port: http
     middlewares:
       - name: longhorn-auth
diff --git a/apps/metrics/app/route.yaml b/apps/metrics/app/route.yaml
index 525bba8..766f7f2 100644
--- a/apps/metrics/app/route.yaml
+++ b/apps/metrics/app/route.yaml
@@ -9,6 +9,9 @@ spec:
   routes:
   - match: Host(`grafana.trivernis.dev`) || Host(`grafana.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: prometheus-stack-grafana
-      port: 80
+      port: http-web
diff --git a/apps/miniflux/app/route.yaml b/apps/miniflux/app/route.yaml
index 4a548aa..890c01a 100644
--- a/apps/miniflux/app/route.yaml
+++ b/apps/miniflux/app/route.yaml
@@ -7,8 +7,11 @@ spec:
   entryPoints:
     - web
   routes:
-  - match: Host(`miniflux.trivernis.dev`) || Host(`miniflux.trivernis.net`)
+  - match: Host(`miniflux.trivernis.dev`, `miniflux.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: miniflux
-      port: 8080
+      port: http
diff --git a/apps/plantwiki/app/deploy.yaml b/apps/plantwiki/app/deploy.yaml
index a1f0390..d443017 100644
--- a/apps/plantwiki/app/deploy.yaml
+++ b/apps/plantwiki/app/deploy.yaml
@@ -57,13 +57,11 @@ spec:
   entryPoints:
     - web
   routes:
-  - match: Host(`plantwiki.trivernis.dev`)
+  - match: Host(`plantwiki.trivernis.dev, plantwiki.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: plantwiki-srv
       port: 80
-  - match: Host(`plantwiki.trivernis.net`)
-    kind: Rule
-    services:
-    - name: plantwiki-srv
-      port: 80
\ No newline at end of file
diff --git a/apps/searxng/app/route.yaml b/apps/searxng/app/route.yaml
index 870dbad..81f27db 100644
--- a/apps/searxng/app/route.yaml
+++ b/apps/searxng/app/route.yaml
@@ -7,7 +7,7 @@ spec:
   entryPoints:
     - web
   routes:
-  - match: Host(`search.trivernis.dev`) || Host(`search.trivernis.net`)
+  - match: Host(`search.trivernis.dev`, `search.trivernis.net`)
     kind: Rule
     services:
     - name: searxng-srv
diff --git a/apps/uptime-kuma/app/route.yaml b/apps/uptime-kuma/app/route.yaml
index 35540ca..bc0e8e3 100644
--- a/apps/uptime-kuma/app/route.yaml
+++ b/apps/uptime-kuma/app/route.yaml
@@ -16,15 +16,20 @@ spec:
   entryPoints:
     - web
   routes:
-  - match: Host(`status.cluster.trivernis.dev`) || Host(`status.cluster.trivernis.net`)
+  - match: Host(`status.cluster.trivernis.dev`, `status.cluster.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: uptime-kuma
-      port: 3001
-  - match: Host(`status.trivernis.dev`) || Host(`status.trivernis.net`)
+      port: http 
+  - match: Host(`status.trivernis.dev`, `status.trivernis.net`)
     kind: Rule
     middlewares:
+      - name: strict-security-headers
+        namespace: default
       - name: prefix-dashboard-services
     services:
     - name: uptime-kuma
-      port: 3001
+      port: http