diff --git a/cluster/platform/external-dns/values.yaml b/cluster/platform/external-dns/values.yaml
index 8e59e82..51c58d0 100644
--- a/cluster/platform/external-dns/values.yaml
+++ b/cluster/platform/external-dns/values.yaml
@@ -35,10 +35,11 @@ env:
 domainFilters:
   - local.mk-labs.cloud
 
-# Only process Ingress resources (and Services with the right annotation)
+# Sources: ingress, service, and Gateway API HTTPRoutes
 sources:
   - ingress
   - service
+  - gateway-httproute
 
 # Annotation to opt services into DNS management:
 # external-dns.alpha.kubernetes.io/hostname: myservice.local.mk-labs.cloud
diff --git a/hello-world.yaml b/hello-world.yaml
new file mode 100644
index 0000000..f44c29d
--- /dev/null
+++ b/hello-world.yaml
@@ -0,0 +1,126 @@
+# ------------------------------------------------------------------------------
+# hello-world — Gateway API + cert-manager + external-dns end-to-end test
+#
+# Tests:
+#   - Cilium Gateway provisioning (10.1.71.90 from cilium-gateway pool)
+#   - cert-manager DNS-01 cert issuance (letsencrypt-staging)
+#   - external-dns CNAME creation in Technitium via RFC2136
+#   - HTTPRoute routing to backend service
+#
+# Cleanup when done:
+#   kubectl delete -f hello-world.yaml -n default
+# ------------------------------------------------------------------------------
+
+# Gateway — one per cluster (shared by all HTTPRoutes)
+# This is the only Gateway you'll ever need for internal cluster traffic.
+# Pin to 10.1.71.90 via annotation — first IP in the cilium-gateway pool.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fastpass-gateway
+  namespace: default
+  annotations:
+    io.cilium/lb-ipam-ips: "10.1.71.90"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: hello-world-tls
+            kind: Secret
+      allowedRoutes:
+        namespaces:
+          from: Same
+---
+# Certificate — staging issuer to avoid LE rate limits during testing
+# Switch to letsencrypt-prod once staging validates successfully
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hello-world-tls
+  namespace: default
+spec:
+  secretName: hello-world-tls
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  dnsNames:
+    - hello.local.mk-labs.cloud
+---
+# Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hello-world
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hello-world
+  template:
+    metadata:
+      labels:
+        app: hello-world
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: hello-world
+          image: nginxdemos/hello:plain-text
+          ports:
+            - containerPort: 80
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: hello-world
+  namespace: default
+spec:
+  selector:
+    app: hello-world
+  ports:
+    - port: 80
+      targetPort: 80
+---
+# HTTPRoute — handles both HTTP and HTTPS listeners
+# external-dns watches this resource and creates the DNS record in Technitium
+# because the hostname annotation is present.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: hello-world
+  namespace: default
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: hello.local.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/target: "10.1.71.90"
+spec:
+  parentRefs:
+    - name: fastpass-gateway
+      sectionName: https
+  hostnames:
+    - hello.local.mk-labs.cloud
+  rules:
+    - backendRefs:
+        - name: hello-world
+          port: 80