diff --git a/apps/garage/httproute-s3.yaml b/apps/garage/httproute-s3.yaml
new file mode 100644
index 0000000..8aeb881
--- /dev/null
+++ b/apps/garage/httproute-s3.yaml
@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: garage-s3
+  namespace: garage
+spec:
+  hostnames:
+    - s3.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: garage
+          port: 3900
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
diff --git a/apps/garage/kustomization.yaml b/apps/garage/kustomization.yaml
index 43f3b4c..894f6c8 100644
--- a/apps/garage/kustomization.yaml
+++ b/apps/garage/kustomization.yaml
@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - httproute-s3.yaml
   - sealed-secret.yaml
   - service-admin.yaml
diff --git a/argocd-apps/services/garage.yaml b/argocd-apps/services/garage.yaml
index 331fad2..96c4d3c 100644
--- a/argocd-apps/services/garage.yaml
+++ b/argocd-apps/services/garage.yaml
@@ -20,7 +20,7 @@ spec:
             singleNode: true
             existingRpcSecret: garage-secrets
             noClusterRole: true
-            # No discovery or website listener is needed for standalone S3.
+            # No discovery is needed for a single node.
             garageTomlString: |
               metadata_dir = "/mnt/meta"
               data_dir = "/mnt/data"
@@ -36,6 +36,12 @@ spec:
               s3_region = "garage"
               api_bind_addr = "0.0.0.0:3900"
 
+              [s3_web]
+              bind_addr = "0.0.0.0:3902"
+              # Required; a bucket's full name also works as the Host
+              root_domain = ".web.garage.internal"
+              index = "index.html"
+
               [admin]
               api_bind_addr = "0.0.0.0:3903"
               metrics_require_token = true