diff --git a/charts/outprint/Chart.yaml b/charts/outprint/Chart.yaml
index 760c722..4b5958f 100644
--- a/charts/outprint/Chart.yaml
+++ b/charts/outprint/Chart.yaml
@@ -15,7 +15,7 @@ sources:
   - https://github.com/taskmedia/helm
 icon: https://media.task.media/images/logo.png
 type: application
-version: 1.0.0
+version: 1.1.0
 # outprint release tag without the leading v
 appVersion: "1.0.0"
 
@@ -33,4 +33,4 @@ annotations:
       image: ghcr.io/taskmedia/outprint-injector:1.0.0
   artifacthub.io/changes: |
     - kind: added
-      description: Initial chart for the Gateway, the Worker and the injector
+      description: Optional Traefik IngressRoute (ingressRoute.*) for the injector with optional cert-manager Certificate
diff --git a/charts/outprint/README.md b/charts/outprint/README.md
index 1414d41..a812345 100644
--- a/charts/outprint/README.md
+++ b/charts/outprint/README.md
@@ -23,3 +23,27 @@ Gateway or the Worker. For PDF by link only, set `injector.enabled=false`.
 ## Values
 
 See [values.yaml](values.yaml); every option is commented. `outline.url` is required.
+
+## IngressRoute
+
+As an alternative to `injector.ingress`, the chart can render a Traefik `IngressRoute` (CRD) that
+sends the whole host to the injector. The injector forwards `/pdf/*` to the Gateway and everything
+else to Outline, so no prefix middleware is needed. Move the host off Outline's own Ingress first;
+two routers must not claim it. cert-manager's ingress-shim does not handle `IngressRoute`, so the
+chart can also create the `Certificate`:
+
+```yaml
+outline:
+  url: http://outline.outline.svc:3000
+ingressRoute:
+  enabled: true
+  host: wiki.example.com
+  tls:
+    secretName: outprint-tls
+    certificate:
+      enabled: true
+      issuerRef:
+        name: letsencrypt-prod
+```
+
+Needs `injector.enabled` and the Traefik (and, for the certificate, cert-manager) CRDs in the cluster.
diff --git a/charts/outprint/templates/certificate.yaml b/charts/outprint/templates/certificate.yaml
new file mode 100644
index 0000000..b236f54
--- /dev/null
+++ b/charts/outprint/templates/certificate.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.ingressRoute.enabled .Values.ingressRoute.tls.certificate.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "{{ include "outprint.fullname" . }}"
+  labels:
+    {{- include "outprint.labels" . | nindent 4 }}
+spec:
+  secretName: {{ required "ingressRoute.tls.secretName is required for the certificate" .Values.ingressRoute.tls.secretName }}
+  dnsNames:
+    - {{ required "ingressRoute.host is required" .Values.ingressRoute.host | quote }}
+  issuerRef:
+    name: {{ required "ingressRoute.tls.certificate.issuerRef.name is required" .Values.ingressRoute.tls.certificate.issuerRef.name }}
+    kind: {{ .Values.ingressRoute.tls.certificate.issuerRef.kind }}
+    group: {{ .Values.ingressRoute.tls.certificate.issuerRef.group }}
+{{- end }}
diff --git a/charts/outprint/templates/ingressroute.yaml b/charts/outprint/templates/ingressroute.yaml
new file mode 100644
index 0000000..346910f
--- /dev/null
+++ b/charts/outprint/templates/ingressroute.yaml
@@ -0,0 +1,36 @@
+{{- if .Values.ingressRoute.enabled }}
+{{- $host := required "ingressRoute.host is required" .Values.ingressRoute.host }}
+{{- if not .Values.injector.enabled }}
+{{- fail "ingressRoute.enabled needs injector.enabled: the IngressRoute sends the whole host to the injector, which forwards /pdf/* to the Gateway" }}
+{{- end }}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: "{{ include "outprint.fullname" . }}-injector"
+  labels:
+    {{- include "outprint.labels" . | nindent 4 }}
+  {{- with .Values.ingressRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  entryPoints:
+    {{- toYaml .Values.ingressRoute.entryPoints | nindent 4 }}
+  routes:
+    - match: Host(`{{ $host }}`)
+      kind: Rule
+      {{- with .Values.ingressRoute.priority }}
+      priority: {{ . }}
+      {{- end }}
+      {{- with .Values.ingressRoute.middlewares }}
+      middlewares:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      services:
+        - name: "{{ include "outprint.fullname" . }}-injector"
+          port: {{ .Values.injector.service.port }}
+  {{- with .Values.ingressRoute.tls.secretName }}
+  tls:
+    secretName: {{ . }}
+  {{- end }}
+{{- end }}
diff --git a/charts/outprint/values.yaml b/charts/outprint/values.yaml
index 2ae8807..fc487c3 100644
--- a/charts/outprint/values.yaml
+++ b/charts/outprint/values.yaml
@@ -112,3 +112,30 @@ injector:
     annotations: {}
     hosts: []   # for example [wiki.example.test]
     tls: []
+
+# Optional Traefik IngressRoute (CRD) for the injector. The whole host goes to
+# the injector, which forwards /pdf/* to the Gateway and everything else to
+# Outline, so no prefix middleware is needed. Needs injector.enabled. Use
+# either this or injector.ingress, not both.
+ingressRoute:
+  enabled: false
+  annotations: {}
+  entryPoints:
+    - websecure
+  host: ""
+  # Set it higher than the priority of any other router for the same host,
+  # for example Outline's own Ingress. Empty = Traefik's default.
+  priority: ""
+  # middlewares is a list of Traefik middleware references (name, optional namespace)
+  middlewares: []
+  tls:
+    # secretName enables TLS for ingressRoute.host
+    secretName: ""
+    # certificate creates a cert-manager Certificate for ingressRoute.host
+    # stored in tls.secretName
+    certificate:
+      enabled: false
+      issuerRef:
+        name: ""
+        kind: ClusterIssuer
+        group: cert-manager.io