diff --git a/helm/cluster-chart/README.md b/helm/cluster-chart/README.md
index b36827e..7b018d6 100644
--- a/helm/cluster-chart/README.md
+++ b/helm/cluster-chart/README.md
@@ -11,7 +11,7 @@ It is the workload-facing companion to the [RavenDB Operator chart](../chart/REA
 - Deploys resources into the release namespace (the namespace must already exist, or be created at install time with `helm install --create-namespace`).
 - Provisions cert and license Secrets from `--set-file` inputs (or references pre-existing Secrets when no file is provided).
 - Renders a `RavenDBCluster` CR from `values.yaml` (values mirror `RavenDBClusterSpec` 1:1).
-- When `externalAccessConfiguration.type == ingress-controller` and `ingressClassName == traefik`, renders one `IngressRouteTCP` per node for HTTPS (port 443) and TCP (port 38888), with TLS passthrough. Hostnames are extracted from `publicServerUrl` and `publicServerUrlTcp`. Both routes target the per-node Service `ravendb-<tag>` (created by the operator). Traefik entrypoint names are configurable via `traefik.entryPoints.https` and `traefik.entryPoints.tcp`.
+- When `externalAccessConfiguration.type == ingress-controller` and `ingressClassName == traefik`, renders one `IngressRouteTCP` per node for HTTPS (port 443) and TCP (port 38888), with TLS passthrough. Hostnames are extracted from `publicServerUrl` and `publicServerUrlTcp`. Both routes target the per-node Service `ravendb-<tag>` (created by the operator). Traefik entrypoint names are configurable via `traefik.entryPoints.https` and `traefik.entryPoints.tcp`; annotations for all generated routes are configurable via `traefik.annotations`.
 
 ## What this chart does NOT do
 
@@ -94,6 +94,7 @@ Pass `--create-namespace` if the namespace doesn't already exist. Installing int
 | `spec.*` | Mirrors `RavenDBClusterSpec` 1:1. Required fields fail at template time if missing. |
 | `traefik.entryPoints.https` | Traefik entrypoint name for HTTPS routes. Default: `websecure`. |
 | `traefik.entryPoints.tcp` | Traefik entrypoint name for TCP routes. Default: `tcp`. |
+| `traefik.annotations` | Annotations applied to all generated Traefik `IngressRouteTCP` resources. Default: `{}`. |
 
 See [`values.yaml`](values.yaml) for the full shape and inline documentation, including all `spec.*` fields (nodes, mode, domain, external access types, storage, env, additional volumes, …).
 
diff --git a/helm/cluster-chart/templates/traefik-ingressroutetcp.yaml b/helm/cluster-chart/templates/traefik-ingressroutetcp.yaml
index f55559b..0a07589 100644
--- a/helm/cluster-chart/templates/traefik-ingressroutetcp.yaml
+++ b/helm/cluster-chart/templates/traefik-ingressroutetcp.yaml
@@ -6,6 +6,7 @@
 {{- if eq (default "" $ic.ingressClassName) "traefik" }}
 {{- $httpsEntry := required "traefik.entryPoints.https is required" .Values.traefik.entryPoints.https }}
 {{- $tcpEntry := required "traefik.entryPoints.tcp is required" .Values.traefik.entryPoints.tcp }}
+{{- $annotations := default dict .Values.traefik.annotations }}
 {{- range .Values.spec.nodes }}
 {{- /* k8s object names must be RFC 1035 lowercase; the operator lowercases the tag when building Service names, so we do the same to match. The CR-level .tag stays as-is (RavenDB convention preserves case). */}}
 {{- $svcName := printf "ravendb-%s" (.tag | lower) }}
@@ -25,6 +26,10 @@ metadata:
   namespace: {{ $.Release.Namespace }}
   labels:
     {{- include "ravendb-cluster.labels" $ | nindent 4 }}
+  {{- with $annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   entryPoints:
     - {{ $httpsEntry }}
@@ -43,6 +48,10 @@ metadata:
   namespace: {{ $.Release.Namespace }}
   labels:
     {{- include "ravendb-cluster.labels" $ | nindent 4 }}
+  {{- with $annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   entryPoints:
     - {{ $tcpEntry }}
diff --git a/helm/cluster-chart/values.yaml b/helm/cluster-chart/values.yaml
index d871b8f..cc3618a 100644
--- a/helm/cluster-chart/values.yaml
+++ b/helm/cluster-chart/values.yaml
@@ -22,11 +22,13 @@ nameOverride: ""
 # and one for TCP, with TLS passthrough.
 #
 # entryPoints map to entrypoint names configured at Traefik install time.
+# annotations are applied to every generated Traefik IngressRouteTCP.
 # ------------------------------------------------------------------------------
 traefik:
   entryPoints:
     https: websecure
     tcp: tcp
+  annotations: {}
 
 # ------------------------------------------------------------------------------
 # Secrets - hybrid model: provision via --set-file, OR reference existing Secrets.