diff --git a/filebrowser/auth.yaml b/filebrowser/auth.yaml
new file mode 100644
index 0000000..fd7fd35
--- /dev/null
+++ b/filebrowser/auth.yaml
@@ -0,0 +1,23 @@
+---
+# Basic-auth credentials in htpasswd format (bcrypt-hashed).
+# Generated with: htpasswd -nbB chemavx <password>
+apiVersion: v1
+kind: Secret
+metadata:
+  name: filebrowser-auth
+  namespace: filebrowser
+type: Opaque
+stringData:
+  users: |
+    chemavx:$2b$12$a1vb6zKuvbpvw8XWJk2ZYeAZtLGkJ.VsdOuMQhC5HmdC0cdnLzNhC
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: filebrowser-auth
+  namespace: filebrowser
+spec:
+  basicAuth:
+    secret: filebrowser-auth
+    realm: "Filebrowser"
diff --git a/filebrowser/deployment.yaml b/filebrowser/deployment.yaml
index 6cbc207..c14c13c 100644
--- a/filebrowser/deployment.yaml
+++ b/filebrowser/deployment.yaml
@@ -97,6 +97,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: filebrowser-filebrowser-auth@kubernetescrd
 spec:
   ingressClassName: traefik
   rules: