diff --git a/zona-exclusion/deployment.yaml b/zona-exclusion/deployment.yaml
index b92c1dc..7c94356 100644
--- a/zona-exclusion/deployment.yaml
+++ b/zona-exclusion/deployment.yaml
@@ -102,6 +102,20 @@ spec:
       targetPort: 2368
 
 ---
+# www -> apex (canonical) 301 redirect. Mirrors EN's redirect-to-www-https,
+# INVERTED: ES canonical is the APEX. The regex matches only the www host, so
+# the apex router (created from the same Ingress) is a no-op and serves normally.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-www-to-apex
+  namespace: zona-exclusion
+spec:
+  redirectRegex:
+    permanent: true
+    regex: ^https?://www\.zonadeexclusion\.com/(.*)
+    replacement: https://zonadeexclusion.com/${1}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -110,6 +124,9 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    # Applied to all routers from this Ingress; the regex no-ops on the apex,
+    # so only www.zonadeexclusion.com is 301'd to the apex.
+    traefik.ingress.kubernetes.io/router.middlewares: zona-exclusion-redirect-www-to-apex@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
@@ -123,9 +140,20 @@ spec:
                 name: zona-exclusion
                 port:
                   number: 80
+    - host: www.zonadeexclusion.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: zona-exclusion
+                port:
+                  number: 80
   tls:
     - hosts:
         - zonadeexclusion.com
+        - www.zonadeexclusion.com
       secretName: zona-exclusion-tls
 
 # Secret gestionado manualmente — NO añadir aquí para evitar que ArgoCD sobreescriba.