diff --git a/Cargo.lock b/Cargo.lock
index 2bb17b2..25648a0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -320,6 +320,45 @@ dependencies = [
  "regex-syntax",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "async-channel"
 version = "1.9.0"
@@ -1257,6 +1296,20 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -1812,16 +1865,23 @@ dependencies = [
  "grass-node-protocol",
  "grass-validator",
  "hex",
+ "hyper-util",
  "mime_guess",
+ "rcgen",
  "reqwest 0.12.28",
+ "rustls",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "sha2",
  "subtle",
  "sysinfo",
  "tar",
+ "tempfile",
  "thiserror",
+ "time",
  "tokio",
+ "tokio-rustls",
  "tokio-tungstenite 0.26.2",
  "tokio-util",
  "toml 0.8.23",
@@ -1830,6 +1890,7 @@ dependencies = [
  "url",
  "uuid",
  "walkdir",
+ "x509-parser",
 ]
 
 [[package]]
@@ -2512,7 +2573,7 @@ dependencies = [
  "httpdate",
  "idna",
  "mime",
- "nom",
+ "nom 8.0.0",
  "percent-encoding",
  "quoted_printable",
  "rustls",
@@ -2737,6 +2798,12 @@ dependencies = [
  "unicase",
 ]
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -2813,6 +2880,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "nom"
 version = "8.0.0"
@@ -2972,6 +3049,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -3500,6 +3586,20 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "rcgen"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10b99e0098aa4082912d4c649628623db6aba77335e4f4569ff5083a6448b32e"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
 [[package]]
 name = "redis"
 version = "0.31.0"
@@ -3807,6 +3907,15 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom 7.1.3",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -3848,6 +3957,15 @@ dependencies = [
  "security-framework",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.14.1"
@@ -4769,6 +4887,19 @@ dependencies = [
  "xattr",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.18"
@@ -6037,6 +6168,24 @@ dependencies = [
  "tap",
 ]
 
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom 7.1.3",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -6053,6 +6202,15 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.2"
diff --git a/Cargo.toml b/Cargo.toml
index 4e54e23..91ff43c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -33,6 +33,7 @@ bytes = "1"
 clap = { version = "4.5.50", features = ["derive", "env"] }
 config = { version = "0.15.19", default-features = false, features = ["toml"] }
 hex = "0.4"
+hyper-util = { version = "0.1", features = ["server-auto", "service", "tokio"] }
 image = { version = "0.25", default-features = false, features = ["png"] }
 lettre = { version = "0.11", default-features = false, features = ["builder", "hostname", "pool", "sendmail-transport", "smtp-transport", "tokio1", "tokio1-rustls-tls"] }
 jsonwebtoken = "9"
@@ -42,6 +43,9 @@ rand = "0.8"
 redis = { version = "0.31.0", default-features = false, features = ["tokio-comp", "aio", "script"] }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
 ring = "0.17"
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
+rustls-pemfile = "2"
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
 tokio-tungstenite = { version = "0.26", default-features = false, features = ["connect", "rustls-tls-native-roots"] }
 rust-embed = "8"
 sea-orm = { version = "2.0.0-rc.38", default-features = false, features = ["macros", "sqlx-postgres", "runtime-tokio-rustls", "with-json", "with-time", "with-uuid"] }
@@ -62,6 +66,7 @@ tracing-subscriber = { version = "0.3.20", features = ["env-filter", "fmt", "jso
 url = "2.5.4"
 uuid = { version = "1.18.1", features = ["serde", "v7"] }
 walkdir = "2"
+x509-parser = "0.18"
 webp = "0.3"
 zip = { version = "2", default-features = false, features = ["deflate"] }
 bollard = "0.19"
diff --git a/apps/console/src/features/admin/admin-route.test.tsx b/apps/console/src/features/admin/admin-route.test.tsx
index 8603cc6..bc378d1 100644
--- a/apps/console/src/features/admin/admin-route.test.tsx
+++ b/apps/console/src/features/admin/admin-route.test.tsx
@@ -77,6 +77,7 @@ it("lists nodes with health state for administrators", async () => {
           {
             id: "node-1",
             name: "build-node-1",
+            region: "default",
             status: "active",
             healthy: true,
             build_enabled: true,
diff --git a/apps/console/src/features/admin/admin.api.ts b/apps/console/src/features/admin/admin.api.ts
index 0994b35..2f3ee44 100644
--- a/apps/console/src/features/admin/admin.api.ts
+++ b/apps/console/src/features/admin/admin.api.ts
@@ -18,6 +18,7 @@ export type NodeStatus = "pending" | "active" | "draining" | "offline" | "disabl
 export interface AdminNode {
   id: string;
   name: string;
+  region: string;
   status: NodeStatus;
   healthy: boolean;
   build_enabled: boolean;
@@ -85,6 +86,7 @@ export interface AdminNodeConfigurationSync {
 export interface NodeConfiguration {
   node: {
     id: string;
+    region: string;
     control_api: string;
     work_root: string;
     capabilities: { build: boolean; serve: boolean };
@@ -716,7 +718,7 @@ export const adminApi = {
   listNodes: () =>
     request<{ nodes: AdminNode[]; local_process: AdminLocalProcessInfo }>("/api/v1/admin/nodes"),
 
-  createNode: (input: { name: string; start_local?: boolean }) =>
+  createNode: (input: { name: string; region?: string; start_local?: boolean }) =>
     request<{
       node: AdminNode;
       token: string;
diff --git a/apps/console/src/features/admin/components/nodes-panel.test.tsx b/apps/console/src/features/admin/components/nodes-panel.test.tsx
index 07648b9..4b60d17 100644
--- a/apps/console/src/features/admin/components/nodes-panel.test.tsx
+++ b/apps/console/src/features/admin/components/nodes-panel.test.tsx
@@ -15,6 +15,7 @@ function jsonResponse(data: unknown): Response {
 const configuration = {
   node: {
     id: "serve-node-1",
+    region: "default",
     control_api: "http://127.0.0.1:7817",
     work_root: "/data/node",
     capabilities: { build: true, serve: true },
@@ -54,6 +55,7 @@ const configuration = {
 const nodeFixture = {
   id: "node-1",
   name: "serve-node-1",
+  region: "default",
   status: "active",
   healthy: true,
   build_enabled: false,
diff --git a/apps/console/src/features/admin/components/nodes-panel.tsx b/apps/console/src/features/admin/components/nodes-panel.tsx
index d8a662e..b7c4016 100644
--- a/apps/console/src/features/admin/components/nodes-panel.tsx
+++ b/apps/console/src/features/admin/components/nodes-panel.tsx
@@ -336,6 +336,7 @@ export function NodesPanel() {
             <TableHeader>
               <TableRow>
                 <TableHead>Name</TableHead>
+                <TableHead>Region</TableHead>
                 <TableHead>Health</TableHead>
                 <TableHead>Capabilities</TableHead>
                 <TableHead>Serve load</TableHead>
@@ -374,6 +375,9 @@ export function NodesPanel() {
                       </p>
                     )}
                   </TableCell>
+                  <TableCell>
+                    <Badge variant="outline">{node.region}</Badge>
+                  </TableCell>
                   <TableCell>{healthBadge(node)}</TableCell>
                   <TableCell>
                     <div className="flex flex-wrap gap-1">
@@ -770,6 +774,16 @@ function EditConfigurationDialog({ node }: { node: AdminNode }) {
                           )
                         }
                       />
+                      <ConfigurationTextField
+                        id={`node-${node.id}-config-region`}
+                        label="Region"
+                        value={configuration.node.region}
+                        onChange={(region) =>
+                          setConfiguration((current) =>
+                            current ? { ...current, node: { ...current.node, region } } : current,
+                          )
+                        }
+                      />
                       <ConfigurationTextField
                         id={`node-${node.id}-control-api`}
                         label="Control API URL"
@@ -1437,13 +1451,15 @@ function CreateNodeDialog({
 }) {
   const [open, setOpen] = useState(false);
   const [name, setName] = useState("");
+  const [region, setRegion] = useState("default");
   const [startLocal, setStartLocal] = useState(defaultStartLocal);
 
   const createMutation = useMutation({
-    mutationFn: () => adminApi.createNode({ name, start_local: startLocal }),
+    mutationFn: () => adminApi.createNode({ name, region, start_local: startLocal }),
     onSuccess: ({ token, warnings }) => {
       setOpen(false);
       setName("");
+      setRegion("default");
       onCreated(token, warnings ?? []);
     },
   });
@@ -1479,6 +1495,16 @@ function CreateNodeDialog({
               required
             />
           </Field>
+          <Field>
+            <FieldLabel htmlFor="node-region">Region</FieldLabel>
+            <Input
+              id="node-region"
+              placeholder="default"
+              value={region}
+              onChange={(event) => setRegion(event.target.value)}
+              required
+            />
+          </Field>
           <label className="flex items-center gap-2 text-sm">
             <input
               type="checkbox"
diff --git a/apps/console/src/features/deployments/deployment-detail-route.test.tsx b/apps/console/src/features/deployments/deployment-detail-route.test.tsx
index 0e70ea5..064ee23 100644
--- a/apps/console/src/features/deployments/deployment-detail-route.test.tsx
+++ b/apps/console/src/features/deployments/deployment-detail-route.test.tsx
@@ -28,6 +28,7 @@ function detailFixture(overrides: Partial<DeploymentDetail["deployment"]> = {}):
       id: "deployment-1",
       project_id: "project-1",
       team_id: "team-1",
+      region: "default",
       build_node: { id: "build-node-1", name: "builder-1" },
       serve_node: { id: "serve-node-1", name: "serve-node-1" },
       environment: "production",
diff --git a/apps/console/src/features/deployments/deployments-tab.test.tsx b/apps/console/src/features/deployments/deployments-tab.test.tsx
index c688679..543b6cc 100644
--- a/apps/console/src/features/deployments/deployments-tab.test.tsx
+++ b/apps/console/src/features/deployments/deployments-tab.test.tsx
@@ -55,6 +55,7 @@ function deploymentFixture(overrides: Partial<Deployment> = {}): Deployment {
     id: "deployment-1",
     project_id: "project-1",
     team_id: "team-1",
+    region: "default",
     build_node: { id: "build-node-1", name: "builder-1" },
     serve_node: { id: "serve-node-1", name: "serve-node-1" },
     environment: "production",
@@ -149,6 +150,7 @@ it("creates with automatic placement by default and sends a selected serve node"
             {
               id: "node-1",
               name: "serve-node-1",
+              region: "default",
               healthy: true,
               capacity: {
                 cpu_millicores: 1000,
@@ -166,6 +168,7 @@ it("creates with automatic placement by default and sends a selected serve node"
             {
               id: "node-2",
               name: "serve-node-2",
+              region: "eu-west",
               healthy: true,
               capacity: {
                 cpu_millicores: 2000,
diff --git a/apps/console/src/features/deployments/deployments-tab.tsx b/apps/console/src/features/deployments/deployments-tab.tsx
index fe3078c..4884aa8 100644
--- a/apps/console/src/features/deployments/deployments-tab.tsx
+++ b/apps/console/src/features/deployments/deployments-tab.tsx
@@ -57,6 +57,7 @@ export function DeploymentsTab({
   const [deploymentEnvironment, setDeploymentEnvironment] = useState<DeploymentEnvironment | null>(
     null,
   );
+  const [deploymentRegion, setDeploymentRegion] = useState("automatic");
   const [serveNodeId, setServeNodeId] = useState("automatic");
 
   const deploymentsQuery = useQuery({
@@ -90,12 +91,17 @@ export function DeploymentsTab({
   });
 
   const serveNodes = serveNodesQuery.data?.serve_nodes ?? [];
-  const selectedNode = serveNodes.find((node) => node.id === serveNodeId);
+  const regions = [...new Set(serveNodes.map((node) => node.region))].sort();
+  const regionalServeNodes =
+    deploymentRegion === "automatic"
+      ? serveNodes
+      : serveNodes.filter((node) => node.region === deploymentRegion);
+  const selectedNode = regionalServeNodes.find((node) => node.id === serveNodeId);
   const canSubmit =
     !serveNodesQuery.isLoading &&
     !serveNodesQuery.isError &&
     (serveNodeId === "automatic"
-      ? serveNodes.some((node) => node.schedulable)
+      ? regionalServeNodes.some((node) => node.schedulable)
       : selectedNode?.schedulable === true);
 
   useEffect(() => {
@@ -108,6 +114,7 @@ export function DeploymentsTab({
   }, [projectId, serveNodes, serveNodesQuery.data]);
 
   const openDeploymentDialog = (environment: DeploymentEnvironment) => {
+    setDeploymentRegion("automatic");
     setServeNodeId("automatic");
     setDeploymentEnvironment(environment);
   };
@@ -173,10 +180,44 @@ export function DeploymentsTab({
               if (!deploymentEnvironment || !canSubmit) return;
               createMutation.mutate({
                 environment: deploymentEnvironment,
+                ...(deploymentRegion === "automatic" ? {} : { region: deploymentRegion }),
                 ...(serveNodeId === "automatic" ? {} : { serve_node_id: serveNodeId }),
               });
             }}
           >
+            <Field>
+              <FieldLabel htmlFor="deployment-region">Region</FieldLabel>
+              <Select
+                value={deploymentRegion}
+                onValueChange={(value) => {
+                  setDeploymentRegion(value);
+                  setServeNodeId("automatic");
+                }}
+              >
+                <SelectTrigger id="deployment-region" aria-label="Region" className="w-full">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem
+                    value="automatic"
+                    disabled={!serveNodes.some((node) => node.schedulable)}
+                  >
+                    Automatic · any region
+                  </SelectItem>
+                  {regions.map((region) => (
+                    <SelectItem
+                      key={region}
+                      value={region}
+                      disabled={
+                        !serveNodes.some((node) => node.region === region && node.schedulable)
+                      }
+                    >
+                      {region}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </Field>
             <Field>
               <FieldLabel htmlFor="serve-node">Serve node</FieldLabel>
               <Select value={serveNodeId} onValueChange={setServeNodeId}>
@@ -186,13 +227,13 @@ export function DeploymentsTab({
                 <SelectContent>
                   <SelectItem
                     value="automatic"
-                    disabled={!serveNodes.some((node) => node.schedulable)}
+                    disabled={!regionalServeNodes.some((node) => node.schedulable)}
                   >
                     Automatic · least loaded
                   </SelectItem>
-                  {serveNodes.map((node) => (
+                  {regionalServeNodes.map((node) => (
                     <SelectItem key={node.id} value={node.id} disabled={!node.schedulable}>
-                      {node.name} · {formatNodeUsage(node)}
+                      {node.name} · {node.region} · {formatNodeUsage(node)}
                       {node.overflow_only ? " · overflow" : ""}
                     </SelectItem>
                   ))}
@@ -283,7 +324,8 @@ export function DeploymentsTab({
                         {deployment.overcommitted && <Badge variant="warning">Overflow</Badge>}
                       </div>
                       <p className="text-xs text-muted-foreground">
-                        {deployment.serve_node?.name ?? "Unassigned"}
+                        <span>{deployment.serve_node?.name ?? "Unassigned"}</span>
+                        <span> · {deployment.region}</span>
                       </p>
                       <p className="whitespace-nowrap text-xs text-muted-foreground">
                         {deployment.serve_resources.cpu_millicores}m ·{" "}
diff --git a/apps/console/src/features/deployments/deployments.api.ts b/apps/console/src/features/deployments/deployments.api.ts
index bc97577..66d52cd 100644
--- a/apps/console/src/features/deployments/deployments.api.ts
+++ b/apps/console/src/features/deployments/deployments.api.ts
@@ -36,6 +36,7 @@ export interface NodeUsage extends ServeResources {
 export interface ServeNodeTarget {
   id: string;
   name: string;
+  region: string;
   healthy: boolean;
   capacity: NodeResources;
   usage: NodeUsage;
@@ -50,6 +51,7 @@ export interface Deployment {
   id: string;
   project_id: string;
   team_id: string;
+  region: string;
   build_node: NodeRef | null;
   serve_node: NodeRef | null;
   environment: DeploymentEnvironment;
@@ -142,15 +144,24 @@ export const deploymentsApi = {
 
   create: (
     projectId: string,
-    input: { environment: DeploymentEnvironment; branch?: string; serve_node_id?: string },
+    input: {
+      environment: DeploymentEnvironment;
+      branch?: string;
+      serve_node_id?: string;
+      region?: string;
+    },
   ) =>
     request<{ deployment: Deployment }>(`/api/v1/projects/${projectId}/deployments`, {
       method: "POST",
       body: JSON.stringify(input),
     }),
 
-  serveNodes: (projectId: string) =>
-    request<{ serve_nodes: ServeNodeTarget[] }>(`/api/v1/projects/${projectId}/serve-nodes`),
+  serveNodes: (projectId: string, region?: string) => {
+    const query = region ? `?region=${encodeURIComponent(region)}` : "";
+    return request<{ serve_nodes: ServeNodeTarget[] }>(
+      `/api/v1/projects/${projectId}/serve-nodes${query}`,
+    );
+  },
 
   detail: (projectId: string, deploymentId: string) =>
     request<DeploymentDetail>(`/api/v1/projects/${projectId}/deployments/${deploymentId}`),
diff --git a/apps/control-api/src/domain/delivery.rs b/apps/control-api/src/domain/delivery.rs
index 0145c83..cebf780 100644
--- a/apps/control-api/src/domain/delivery.rs
+++ b/apps/control-api/src/domain/delivery.rs
@@ -386,7 +386,15 @@ pub async fn request_release(
     let placement = if target.serve_node_id.is_none()
         || matches!(target.serve_status, DeploymentServeStatus::Retired)
     {
-        Some(scheduler::place_deployment(tx, serve_resources(&target)?, None).await?)
+        Some(
+            scheduler::place_deployment_in_region(
+                tx,
+                serve_resources(&target)?,
+                None,
+                Some(&target.region),
+            )
+            .await?,
+        )
     } else {
         None
     };
@@ -591,6 +599,7 @@ mod tests {
             },
             Placement {
                 node_id,
+                region: "default".to_owned(),
                 overcommitted: false,
                 mode: PlacementMode::Automatic,
             },
@@ -672,6 +681,7 @@ mod tests {
         let node = node::ActiveModel {
             id: Set(Uuid::now_v7()),
             name: Set("serve-1".to_owned()),
+            region: Set("default".to_owned()),
             token_hash: Set("test-token-hash".to_owned()),
             status: Set(NodeStatus::Active),
             build_enabled: Set(true),
diff --git a/apps/control-api/src/domain/deployments.rs b/apps/control-api/src/domain/deployments.rs
index 1d33504..27c818d 100644
--- a/apps/control-api/src/domain/deployments.rs
+++ b/apps/control-api/src/domain/deployments.rs
@@ -231,6 +231,7 @@ pub async fn create_deployment<C: ConnectionTrait>(
         id: Set(Uuid::now_v7()),
         project_id: Set(project.id),
         team_id: Set(project.team_id),
+        region: Set(placement.region.clone()),
         build_node_id: Set(None),
         serve_node_id: Set(Some(placement.node_id)),
         environment: Set(params.environment),
diff --git a/apps/control-api/src/domain/node_deletions.rs b/apps/control-api/src/domain/node_deletions.rs
index d4c4077..7467ff1 100644
--- a/apps/control-api/src/domain/node_deletions.rs
+++ b/apps/control-api/src/domain/node_deletions.rs
@@ -839,6 +839,7 @@ mod tests {
         node::ActiveModel {
             id: Set(Uuid::now_v7()),
             name: Set(name.to_owned()),
+            region: Set("default".to_owned()),
             token_hash: Set(format!("token-{name}")),
             status: Set(NodeStatus::Active),
             build_enabled: Set(true),
@@ -891,6 +892,7 @@ mod tests {
             },
             Placement {
                 node_id: source_node_id,
+                region: "default".to_owned(),
                 overcommitted: false,
                 mode: PlacementMode::Automatic,
             },
@@ -1339,6 +1341,7 @@ mod tests {
             },
             Placement {
                 node_id: fixture.source.id,
+                region: "default".to_owned(),
                 overcommitted: false,
                 mode: PlacementMode::Automatic,
             },
diff --git a/apps/control-api/src/domain/nodes.rs b/apps/control-api/src/domain/nodes.rs
index b4898cb..30432a0 100644
--- a/apps/control-api/src/domain/nodes.rs
+++ b/apps/control-api/src/domain/nodes.rs
@@ -17,6 +17,7 @@ pub fn gateway_token(secret: &str) -> String {
 
 pub struct CreateNodeParams {
     pub name: String,
+    pub region: String,
     pub token_hash: String,
     pub storage_root: Option<String>,
 }
@@ -37,6 +38,7 @@ pub async fn create_node(
     node::ActiveModel {
         id: Set(Uuid::now_v7()),
         name: Set(params.name.clone()),
+        region: Set(params.region),
         token_hash: Set(params.token_hash),
         status: Set(NodeStatus::Pending),
         build_enabled: Set(true),
@@ -145,6 +147,7 @@ pub async fn list<C: ConnectionTrait>(db: &C) -> anyhow::Result<Vec<node::Model>
 
 pub struct RegisterNodeParams {
     pub name: String,
+    pub region: String,
     pub version: String,
     pub build_enabled: bool,
     pub serve_enabled: bool,
@@ -282,6 +285,7 @@ pub async fn apply_registration<C: ConnectionTrait>(
     let initialize_deployments = first_resource_report;
     let mut active: node::ActiveModel = node.into();
     active.name = Set(params.name);
+    active.region = Set(params.region);
     active.build_enabled = Set(params.build_enabled);
     active.serve_enabled = Set(params.serve_enabled);
     active.build_concurrency = Set(if params.build_enabled {
@@ -498,6 +502,7 @@ mod tests {
         node::Model {
             id: Uuid::nil(),
             name: "test".to_owned(),
+            region: "default".to_owned(),
             token_hash: String::new(),
             status,
             build_enabled: true,
diff --git a/apps/control-api/src/domain/retention.rs b/apps/control-api/src/domain/retention.rs
index 7026b5e..159c5b9 100644
--- a/apps/control-api/src/domain/retention.rs
+++ b/apps/control-api/src/domain/retention.rs
@@ -270,6 +270,7 @@ mod tests {
             id: Uuid::now_v7(),
             project_id: Uuid::now_v7(),
             team_id: Uuid::now_v7(),
+            region: "default".to_owned(),
             build_node_id: None,
             serve_node_id: None,
             environment,
diff --git a/apps/control-api/src/domain/scheduler.rs b/apps/control-api/src/domain/scheduler.rs
index f024f55..0c54278 100644
--- a/apps/control-api/src/domain/scheduler.rs
+++ b/apps/control-api/src/domain/scheduler.rs
@@ -27,6 +27,7 @@ GROUP BY d.serve_node_id
 const ELIGIBLE_CANDIDATES_SQL: &str = r#"
 SELECT
     n.id AS node_id,
+    n.region,
     n.capacity_cpu_millicores,
     n.capacity_memory_mb,
     n.capacity_disk_mb,
@@ -83,6 +84,7 @@ pub struct NodeUsage {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Candidate {
     pub node_id: Uuid,
+    pub region: String,
     pub capacity: NodeResources,
     pub usage: NodeUsage,
 }
@@ -93,9 +95,10 @@ pub enum PlacementMode {
     Manual,
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Placement {
     pub node_id: Uuid,
+    pub region: String,
     pub overcommitted: bool,
     pub mode: PlacementMode,
 }
@@ -104,6 +107,8 @@ pub struct Placement {
 pub enum ScheduleError {
     #[error("no serve node has enough capacity")]
     NoCapacity,
+    #[error("no healthy serve node is available in region '{0}'")]
+    NoCapacityInRegion(String),
     #[error("selected serve node is unavailable")]
     SelectedNodeUnavailable,
     #[error("selected serve node has no remaining capacity")]
@@ -194,6 +199,29 @@ pub fn choose_candidate(
     )
 }
 
+pub fn choose_candidate_in_region(
+    candidates: &[Candidate],
+    requested: ServeResources,
+    region: Option<&str>,
+    selected_node_id: Option<Uuid>,
+) -> Result<Placement, ScheduleError> {
+    let filtered = region
+        .map(|region| {
+            candidates
+                .iter()
+                .filter(|candidate| candidate.region == region)
+                .cloned()
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_else(|| candidates.to_vec());
+    if let Some(region) = region
+        && filtered.is_empty()
+    {
+        return Err(ScheduleError::NoCapacityInRegion(region.to_owned()));
+    }
+    choose_candidate(&filtered, requested, selected_node_id)
+}
+
 pub fn choose_candidate_with_rng<R: Rng + ?Sized>(
     candidates: &[Candidate],
     requested: ServeResources,
@@ -212,6 +240,7 @@ pub fn choose_candidate_with_rng<R: Rng + ?Sized>(
         }
         return Ok(Placement {
             node_id: candidate.node_id,
+            region: candidate.region.clone(),
             overcommitted: !candidate.projected(requested).all_at_most_one(),
             mode: PlacementMode::Manual,
         });
@@ -229,6 +258,7 @@ pub fn choose_candidate_with_rng<R: Rng + ?Sized>(
     ) {
         return Ok(Placement {
             node_id: candidate.node_id,
+            region: candidate.region.clone(),
             overcommitted: false,
             mode: PlacementMode::Automatic,
         });
@@ -241,6 +271,7 @@ pub fn choose_candidate_with_rng<R: Rng + ?Sized>(
     )
     .map(|candidate| Placement {
         node_id: candidate.node_id,
+        region: candidate.region.clone(),
         overcommitted: true,
         mode: PlacementMode::Automatic,
     })
@@ -273,14 +304,15 @@ where
     tied.choose(rng).copied()
 }
 
-pub async fn place_deployment(
+pub async fn place_deployment_in_region(
     transaction: &DatabaseTransaction,
     requested: ServeResources,
     selected_node_id: Option<Uuid>,
+    region: Option<&str>,
 ) -> Result<Placement, ScheduleError> {
     lock_placement(transaction).await?;
     let candidates = eligible_candidates(transaction).await?;
-    choose_candidate(&candidates, requested, selected_node_id)
+    choose_candidate_in_region(&candidates, requested, region, selected_node_id)
 }
 
 /// Serializes operations that can change whether a Serve Node has room for
@@ -328,6 +360,7 @@ pub async fn eligible_candidates<C: ConnectionTrait>(
 #[derive(Debug, FromQueryResult)]
 struct CandidateRow {
     node_id: Uuid,
+    region: String,
     capacity_cpu_millicores: i64,
     capacity_memory_mb: i64,
     capacity_disk_mb: i64,
@@ -378,6 +411,7 @@ impl TryFrom<CandidateRow> for Candidate {
     fn try_from(row: CandidateRow) -> Result<Self, Self::Error> {
         Ok(Self {
             node_id: row.node_id,
+            region: row.region,
             capacity: NodeResources {
                 cpu_millicores: row
                     .capacity_cpu_millicores
@@ -448,6 +482,7 @@ mod tests {
     ) -> Candidate {
         Candidate {
             node_id: Uuid::from_u128(id),
+            region: "default".to_owned(),
             capacity: NodeResources {
                 cpu_millicores: capacity.0,
                 memory_mb: capacity.1,
@@ -483,6 +518,25 @@ mod tests {
         assert_eq!(placement.mode, PlacementMode::Automatic);
     }
 
+    #[test]
+    fn regional_candidates_are_limited_to_the_requested_region() {
+        let candidates = vec![
+            candidate_in_region(1, "us-east"),
+            candidate_in_region(2, "eu-west"),
+        ];
+
+        let placement =
+            choose_candidate_in_region(&candidates, request(), Some("eu-west"), None).unwrap();
+
+        assert_eq!(placement.node_id, Uuid::from_u128(2));
+    }
+
+    fn candidate_in_region(id: u128, region: &str) -> Candidate {
+        let mut candidate = candidate(id, (2_000, 2_000, 10_000, 10), (0, 0, 0, 0));
+        candidate.region = region.to_owned();
+        candidate
+    }
+
     #[test]
     fn selection_uses_projected_dominant_resource() {
         let lower_current = candidate(1, (1_000, 1_000, 10_000, 10), (0, 0, 0, 0));
diff --git a/apps/control-api/src/domain/storage_migrations.rs b/apps/control-api/src/domain/storage_migrations.rs
index 5acc142..002323d 100644
--- a/apps/control-api/src/domain/storage_migrations.rs
+++ b/apps/control-api/src/domain/storage_migrations.rs
@@ -477,6 +477,7 @@ mod tests {
             std::env::temp_dir().join(format!("grass-migration-node-{}.toml", Uuid::now_v7()));
         let node_config = GenerateParams {
             node_name: "local-node",
+            region: "default",
             node_token: "node-token",
             control_api_url: "http://127.0.0.1:7817".to_owned(),
             storage_root: source_root.to_str().unwrap(),
diff --git a/apps/control-api/src/features/api/v1/admin/nodes.rs b/apps/control-api/src/features/api/v1/admin/nodes.rs
index 34ab006..c6bac79 100644
--- a/apps/control-api/src/features/api/v1/admin/nodes.rs
+++ b/apps/control-api/src/features/api/v1/admin/nodes.rs
@@ -76,6 +76,7 @@ fn node_view(
         "build_enabled": node.build_enabled,
         "serve_enabled": node.serve_enabled,
         "build_concurrency": node.build_concurrency,
+        "region": node.region,
         "base_url": node.base_url,
         "work_root": node.work_root,
         "version": node.metadata.get("version"),
@@ -328,6 +329,9 @@ fn validate_node_configuration(
     if identity.id.trim().is_empty() || identity.id.chars().count() > 120 {
         return Err("node id must contain between 1 and 120 characters".to_owned());
     }
+    if grass_validator::normalize_region(&identity.region).is_err() {
+        return Err("node region is invalid".to_owned());
+    }
     if !validate_http_url(identity.control_api.trim()) {
         return Err("control API must be an absolute HTTP(S) URL without credentials".to_owned());
     }
@@ -351,6 +355,9 @@ fn validate_node_configuration(
     if serve.port == 0 {
         return Err("serve port must be greater than zero".to_owned());
     }
+    if serve.tls.enabled && (serve.tls.port == 0 || serve.tls.port == serve.port) {
+        return Err("serve TLS port must be positive and different from the HTTP port".to_owned());
+    }
     if !validate_http_url(serve.public_base_url.trim()) {
         return Err("serve public base URL must be an absolute HTTP(S) URL".to_owned());
     }
@@ -699,6 +706,8 @@ pub async fn health(
 #[derive(Deserialize)]
 pub struct CreateNodeRequest {
     pub name: String,
+    #[serde(default)]
+    pub region: Option<String>,
     /// Generate the local node config and start the managed process.
     #[serde(default)]
     pub start_local: bool,
@@ -722,11 +731,19 @@ pub async fn create(
         });
     }
 
+    let region = body.region.as_deref().unwrap_or("default");
+    let region =
+        grass_validator::normalize_region(region).map_err(|error| AppError::Validation {
+            op: OP,
+            message: format!("region: {error}"),
+        })?;
+
     let token = grass_token::generate_token();
     let node = nodes::create_node(
         db,
         CreateNodeParams {
             name: body.name.trim().to_owned(),
+            region: region.clone(),
             token_hash: grass_token::hash_token(&token),
             storage_root: None,
         },
@@ -771,6 +788,7 @@ pub async fn create(
             &config_path,
             &config_file::GenerateParams {
                 node_name: &node.name,
+                region: &region,
                 node_token: &token,
                 control_api_url,
                 storage_root: &storage_root,
@@ -1002,6 +1020,7 @@ mod tests {
         node::Model {
             id: Uuid::nil(),
             name: "serve-node-1".to_owned(),
+            region: "default".to_owned(),
             token_hash: String::new(),
             status: NodeStatus::Active,
             build_enabled: false,
@@ -1072,6 +1091,20 @@ mod tests {
         let mut configuration = configurable_node();
         assert!(validate_node_configuration(&configuration).is_ok());
 
+        configuration.serve.tls.enabled = true;
+        assert!(validate_node_configuration(&configuration).is_ok());
+        configuration.serve.tls.port = 0;
+        assert_eq!(
+            validate_node_configuration(&configuration).unwrap_err(),
+            "serve TLS port must be positive and different from the HTTP port"
+        );
+        configuration.serve.tls.port = configuration.serve.port;
+        assert_eq!(
+            validate_node_configuration(&configuration).unwrap_err(),
+            "serve TLS port must be positive and different from the HTTP port"
+        );
+        configuration = configurable_node();
+
         configuration.node.capabilities.build = false;
         configuration.node.capabilities.serve = false;
         assert_eq!(
diff --git a/apps/control-api/src/features/api/v1/internal/deployments.rs b/apps/control-api/src/features/api/v1/internal/deployments.rs
index 0df7888..5a51f3d 100644
--- a/apps/control-api/src/features/api/v1/internal/deployments.rs
+++ b/apps/control-api/src/features/api/v1/internal/deployments.rs
@@ -1479,6 +1479,7 @@ mod tests {
             id: Uuid::now_v7(),
             project_id,
             team_id,
+            region: "default".to_owned(),
             build_node_id: None,
             serve_node_id: None,
             environment: DeploymentEnvironment::Preview,
@@ -1580,6 +1581,7 @@ mod tests {
         let authenticated_node = node::Model {
             id: node_id,
             name: "build-1".to_owned(),
+            region: "default".to_owned(),
             token_hash: "unused".to_owned(),
             status: NodeStatus::Active,
             build_enabled: true,
diff --git a/apps/control-api/src/features/api/v1/internal/nodes.rs b/apps/control-api/src/features/api/v1/internal/nodes.rs
index ee8e3d2..9a11312 100644
--- a/apps/control-api/src/features/api/v1/internal/nodes.rs
+++ b/apps/control-api/src/features/api/v1/internal/nodes.rs
@@ -44,6 +44,12 @@ pub async fn register(
         node,
         RegisterNodeParams {
             name,
+            region: grass_validator::normalize_region(&body.region).map_err(|error| {
+                AppError::Validation {
+                    op: OP,
+                    message: format!("region: {error}"),
+                }
+            })?,
             version: body.version,
             build_enabled: body.capabilities.build,
             serve_enabled: body.capabilities.serve,
@@ -88,6 +94,9 @@ pub async fn register(
 }
 
 fn validate_registration(body: &RegisterRequest) -> Result<(), &'static str> {
+    if grass_validator::normalize_region(&body.region).is_err() {
+        return Err("region is invalid");
+    }
     if !body.capabilities.build && !body.capabilities.serve {
         return Err("node must enable build or serve");
     }
@@ -159,6 +168,7 @@ mod tests {
             name: "node-a".to_owned(),
             version: "0.1.0".to_owned(),
             capabilities: NodeCapabilities { build, serve },
+            region: "default".to_owned(),
             build_concurrency: u16::from(build),
             serve_base_url: serve.then(|| "http://node-a:8080".to_owned()),
             resources: serve.then_some(grass_node_protocol::NodeResources {
diff --git a/apps/control-api/src/features/api/v1/internal/serve.rs b/apps/control-api/src/features/api/v1/internal/serve.rs
index 175baf0..63fbb67 100644
--- a/apps/control-api/src/features/api/v1/internal/serve.rs
+++ b/apps/control-api/src/features/api/v1/internal/serve.rs
@@ -70,12 +70,14 @@ fn route_revision(routes: &[ServeRoute]) -> String {
     canonical.sort_by(|left, right| {
         (
             &left.host,
+            &left.region,
             left.deployment_id,
             left.target_node_id,
             &left.target_base_url,
         )
             .cmp(&(
                 &right.host,
+                &right.region,
                 right.deployment_id,
                 right.target_node_id,
                 &right.target_base_url,
@@ -622,6 +624,7 @@ pub async fn routes(
                 .into_iter()
                 .map(|(host, access)| ServeRoute {
                     host,
+                    region: deployment.region.clone(),
                     deployment_id: deployment.id,
                     target_node_id: node_id,
                     target_base_url: target_base_url.clone(),
@@ -867,6 +870,7 @@ mod tests {
         };
         let first = ServeRoute {
             host: "a.example.com".to_owned(),
+            region: "default".to_owned(),
             deployment_id: Uuid::now_v7(),
             target_node_id: Uuid::now_v7(),
             target_base_url: "http://node-a:8080".to_owned(),
@@ -875,6 +879,7 @@ mod tests {
         };
         let second = ServeRoute {
             host: "b.example.com".to_owned(),
+            region: "default".to_owned(),
             deployment_id: Uuid::now_v7(),
             target_node_id: Uuid::now_v7(),
             target_base_url: "http://node-b:8080".to_owned(),
diff --git a/apps/control-api/src/features/api/v1/projects/deployments.rs b/apps/control-api/src/features/api/v1/projects/deployments.rs
index edca756..e8a37eb 100644
--- a/apps/control-api/src/features/api/v1/projects/deployments.rs
+++ b/apps/control-api/src/features/api/v1/projects/deployments.rs
@@ -194,6 +194,7 @@ pub(crate) fn deployment_view(
         "id": deployment.id,
         "project_id": deployment.project_id,
         "team_id": deployment.team_id,
+        "region": deployment.region,
         "build_node": node_view(deployment.build_node_id),
         "serve_node": node_view(deployment.serve_node_id),
         "environment": deployments::environment_value(&deployment.environment),
@@ -382,6 +383,14 @@ pub struct CreateDeploymentRequest {
     pub commit_message: Option<String>,
     #[serde(default)]
     pub serve_node_id: Option<Uuid>,
+    #[serde(default)]
+    pub region: Option<String>,
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub struct ServeNodesQuery {
+    #[serde(default)]
+    pub region: Option<String>,
 }
 
 fn default_environment() -> String {
@@ -430,6 +439,7 @@ async fn create_placed_deployment(
     db: &sea_orm::DatabaseConnection,
     params: CreateDeploymentParams,
     selected_node_id: Option<Uuid>,
+    region: Option<&str>,
     op: &'static str,
 ) -> Result<deployment::Model, AppError> {
     let requested = deployments::runtime_serve_resources(&params.project.runtime);
@@ -440,15 +450,22 @@ async fn create_placed_deployment(
             op,
             source: source.into(),
         })?;
-    let placement =
-        match scheduler::place_deployment(&transaction, requested, selected_node_id).await {
-            Ok(placement) => placement,
-            Err(error) => {
-                let error = map_schedule_error(error, op);
-                let _ = transaction.rollback().await;
-                return Err(error);
-            }
-        };
+    let placement = match scheduler::place_deployment_in_region(
+        &transaction,
+        requested,
+        selected_node_id,
+        region,
+    )
+    .await
+    {
+        Ok(placement) => placement,
+        Err(error) => {
+            let error = map_schedule_error(error, op);
+            let _ = transaction.rollback().await;
+            return Err(error);
+        }
+    };
+    let placement_for_event = placement.clone();
     let deployment = match deployments::create_deployment(&transaction, params, placement).await {
         Ok(deployment) => deployment,
         Err(source) => {
@@ -456,7 +473,7 @@ async fn create_placed_deployment(
             return Err(AppError::Infrastructure { op, source });
         }
     };
-    let mode = match placement.mode {
+    let mode = match placement_for_event.mode {
         PlacementMode::Automatic => "automatic",
         PlacementMode::Manual => "manual",
     };
@@ -467,9 +484,9 @@ async fn create_placed_deployment(
         "deployment assigned to serve node",
         json!({
             "mode": mode,
-            "serve_node_id": placement.node_id,
+            "serve_node_id": placement_for_event.node_id,
             "resources": requested,
-            "overcommitted": placement.overcommitted,
+            "overcommitted": placement_for_event.overcommitted,
         }),
     )
     .await
@@ -518,6 +535,15 @@ pub async fn create(
         });
     }
     let environment = parse_environment(&body.environment, OP)?;
+    let requested_region = body
+        .region
+        .as_deref()
+        .map(grass_validator::normalize_region)
+        .transpose()
+        .map_err(|error| AppError::Validation {
+            op: OP,
+            message: format!("region: {error}"),
+        })?;
 
     let quota = QuotaService::new(db, cache);
     let reservation = quota
@@ -575,6 +601,7 @@ pub async fn create(
             source_credential_version_id,
         },
         body.serve_node_id,
+        requested_region.as_deref(),
         OP,
     )
     .await
@@ -790,11 +817,21 @@ pub async fn serve_nodes(
     State(state): State<ControlApiState>,
     session: Session,
     Path(project_id): Path<Uuid>,
+    Query(query): Query<ServeNodesQuery>,
 ) -> Result<impl IntoResponse, AppError> {
     const OP: &str = "deployments.serve_nodes";
     let access = super::project_access(&state, &session, project_id, false, OP).await?;
     let db = super::database(&state, OP)?;
     let requested = deployments::runtime_serve_resources(&access.project.runtime);
+    let requested_region = query
+        .region
+        .as_deref()
+        .map(grass_validator::normalize_region)
+        .transpose()
+        .map_err(|error| AppError::Validation {
+            op: OP,
+            message: format!("region: {error}"),
+        })?;
     let candidates = scheduler::eligible_candidates(db)
         .await
         .map_err(|error| map_schedule_error(error, OP))?;
@@ -821,6 +858,12 @@ pub async fn serve_nodes(
     let views = candidates
         .iter()
         .filter_map(|candidate| {
+            if requested_region
+                .as_deref()
+                .is_some_and(|region| candidate.region != region)
+            {
+                return None;
+            }
             let node = nodes.get(&candidate.node_id)?;
             let placement = scheduler::choose_candidate(
                 std::slice::from_ref(candidate),
@@ -833,10 +876,11 @@ pub async fn serve_nodes(
             Some(json!({
                 "id": node.id,
                 "name": node.name,
+                "region": candidate.region,
                 "healthy": true,
                 "capacity": candidate.capacity,
                 "usage": candidate.usage,
-                "normal_available": placement.is_some_and(|placement| !placement.overcommitted),
+                "normal_available": placement.as_ref().is_some_and(|placement| !placement.overcommitted),
                 "schedulable": placement.is_some(),
                 "overflow_only": placement.is_some_and(|placement| placement.overcommitted),
                 "disk_available_mb": candidate.capacity.disk_mb.saturating_sub(candidate.usage.disk_mb),
@@ -1332,6 +1376,7 @@ pub async fn retry(
             source_credential_version_id: source_deployment.source_credential_version_id,
         },
         None,
+        Some(&source_deployment.region),
         OP,
     )
     .await
diff --git a/apps/control-api/src/features/api/v1/setup/node.rs b/apps/control-api/src/features/api/v1/setup/node.rs
index 7a3070a..1ab3b9c 100644
--- a/apps/control-api/src/features/api/v1/setup/node.rs
+++ b/apps/control-api/src/features/api/v1/setup/node.rs
@@ -64,6 +64,7 @@ pub async fn handler(
         db,
         CreateNodeParams {
             name: name.to_owned(),
+            region: "default".to_owned(),
             token_hash,
             storage_root: storage_root.clone(),
         },
@@ -103,6 +104,7 @@ pub async fn handler(
             &config_path,
             &crate::infra::node_manager::config_file::GenerateParams {
                 node_name: &node.name,
+                region: "default",
                 node_token: &token,
                 control_api_url,
                 storage_root: &storage_root,
diff --git a/apps/control-api/src/infra/database/entity/deployment.rs b/apps/control-api/src/infra/database/entity/deployment.rs
index 4d435fa..c8250e2 100644
--- a/apps/control-api/src/infra/database/entity/deployment.rs
+++ b/apps/control-api/src/infra/database/entity/deployment.rs
@@ -13,6 +13,7 @@ pub struct Model {
     pub id: Uuid,
     pub project_id: Uuid,
     pub team_id: Uuid,
+    pub region: String,
     pub build_node_id: Option<Uuid>,
     pub serve_node_id: Option<Uuid>,
     pub environment: DeploymentEnvironment,
diff --git a/apps/control-api/src/infra/database/entity/node.rs b/apps/control-api/src/infra/database/entity/node.rs
index 127a28b..04ec5b9 100644
--- a/apps/control-api/src/infra/database/entity/node.rs
+++ b/apps/control-api/src/infra/database/entity/node.rs
@@ -9,6 +9,7 @@ pub struct Model {
     #[sea_orm(primary_key, auto_increment = false)]
     pub id: Uuid,
     pub name: String,
+    pub region: String,
     pub token_hash: String,
     pub status: NodeStatus,
     pub build_enabled: bool,
diff --git a/apps/control-api/src/infra/database/migrate.rs b/apps/control-api/src/infra/database/migrate.rs
index 1fb0028..9dea338 100644
--- a/apps/control-api/src/infra/database/migrate.rs
+++ b/apps/control-api/src/infra/database/migrate.rs
@@ -40,6 +40,7 @@ impl MigratorTrait for Migrator {
             Box::new(migration::m20260807_000026_avatars::Migration),
             Box::new(migration::m20260807_000027_deployment_screenshots::Migration),
             Box::new(migration::m20260808_000028_object_storage::Migration),
+            Box::new(migration::m20260908_000029_regional_routing::Migration),
         ]
     }
 }
@@ -150,7 +151,7 @@ mod tests {
     fn registers_audit_foundation_migration() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(11).expect("twelfth migration").name(),
             "m20260729_000012_audit_foundation"
@@ -179,7 +180,7 @@ mod tests {
     fn registers_team_group_review_policy_migration() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(12).expect("thirteenth migration").name(),
             "m20260729_000013_team_group_review_policy"
@@ -190,7 +191,7 @@ mod tests {
     fn registers_node_config_sync_migration() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(13).expect("fourteenth migration").name(),
             "m20260729_000014_node_config_sync"
@@ -201,7 +202,7 @@ mod tests {
     fn registers_node_deletion_queue_migration() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(14).expect("fifteenth migration").name(),
             "m20260729_000015_node_deletion_queue"
@@ -212,7 +213,7 @@ mod tests {
     fn registers_domain_review_policy_after_node_deletion_queue() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(14).expect("fifteenth migration").name(),
             "m20260729_000015_node_deletion_queue"
@@ -227,7 +228,7 @@ mod tests {
     fn registers_project_notifications_after_domain_review_policy() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(15).expect("sixteenth migration").name(),
             "m20260730_000016_domain_review_policy"
@@ -250,7 +251,7 @@ mod tests {
     fn registers_scoped_codes_after_authentication_migrations() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(23).expect("twenty-fourth migration").name(),
             "m20260806_000024_scoped_codes"
@@ -261,7 +262,7 @@ mod tests {
     fn registers_registration_allowlist_after_scoped_codes() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(24).expect("twenty-fifth migration").name(),
             "m20260806_000025_registration_allowlist"
@@ -272,7 +273,7 @@ mod tests {
     fn registers_avatar_versions_after_registration_allowlist() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(25).expect("twenty-sixth migration").name(),
             "m20260807_000026_avatars"
@@ -283,15 +284,19 @@ mod tests {
     fn registers_object_storage_after_deployment_screenshots() {
         let migrations = Migrator::migrations();
 
-        assert_eq!(migrations.len(), 28);
+        assert_eq!(migrations.len(), 29);
         assert_eq!(
             migrations.get(26).expect("twenty-seventh migration").name(),
             "m20260807_000027_deployment_screenshots"
         );
         assert_eq!(
-            migrations.last().expect("last migration").name(),
+            migrations.get(27).expect("twenty-eighth migration").name(),
             "m20260808_000028_object_storage"
         );
+        assert_eq!(
+            migrations.last().expect("last migration").name(),
+            "m20260908_000029_regional_routing"
+        );
     }
 
     #[tokio::test]
@@ -304,7 +309,7 @@ mod tests {
 
         let verification = async {
             Migrator::up(&test_db.db, None).await?;
-            assert_migration_tracking(&test_db.db, 28, 0).await?;
+            assert_migration_tracking(&test_db.db, 29, 0).await?;
             assert_avatar_schema(&test_db.db).await?;
             assert_screenshot_schema(&test_db.db).await?;
             assert_object_storage_schema(&test_db.db).await?;
@@ -325,7 +330,7 @@ mod tests {
             assert_avatar_schema_absent(&test_db.db).await?;
 
             Migrator::up(&test_db.db, Some(3)).await?;
-            assert_migration_tracking(&test_db.db, 28, 0).await?;
+            assert_migration_tracking(&test_db.db, 29, 0).await?;
             assert_avatar_schema(&test_db.db).await?;
             assert_screenshot_schema(&test_db.db).await?;
             assert_object_storage_schema(&test_db.db).await
diff --git a/apps/control-api/src/infra/database/migration/m20260908_000029_regional_routing.rs b/apps/control-api/src/infra/database/migration/m20260908_000029_regional_routing.rs
new file mode 100644
index 0000000..18670a7
--- /dev/null
+++ b/apps/control-api/src/infra/database/migration/m20260908_000029_regional_routing.rs
@@ -0,0 +1,58 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+pub(crate) const UP_SQL: &str = r#"
+ALTER TABLE nodes
+    ADD COLUMN region TEXT NOT NULL DEFAULT 'default',
+    ADD CONSTRAINT ck_nodes_region_nonempty CHECK (char_length(btrim(region)) > 0);
+
+ALTER TABLE deployments
+    ADD COLUMN region TEXT NOT NULL DEFAULT 'default',
+    ADD CONSTRAINT ck_deployments_region_nonempty CHECK (char_length(btrim(region)) > 0);
+
+CREATE INDEX ix_nodes_region_health
+    ON nodes (region, status, last_heartbeat_at)
+    WHERE deleted_at IS NULL AND serve_enabled = TRUE;
+
+CREATE INDEX ix_deployments_region_status
+    ON deployments (region, serve_status)
+    WHERE deleted_at IS NULL;
+"#;
+
+pub(crate) const DOWN_SQL: &str = r#"
+DROP INDEX IF EXISTS ix_deployments_region_status;
+DROP INDEX IF EXISTS ix_nodes_region_health;
+ALTER TABLE deployments DROP CONSTRAINT ck_deployments_region_nonempty, DROP COLUMN region;
+ALTER TABLE nodes DROP CONSTRAINT ck_nodes_region_nonempty, DROP COLUMN region;
+"#;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager.get_connection().execute_unprepared(UP_SQL).await?;
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .get_connection()
+            .execute_unprepared(DOWN_SQL)
+            .await?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn migration_adds_defaulted_regions_and_indexes() {
+        assert!(UP_SQL.contains("ADD COLUMN region TEXT NOT NULL DEFAULT 'default'"));
+        assert!(UP_SQL.contains("ix_nodes_region_health"));
+        assert!(UP_SQL.contains("ix_deployments_region_status"));
+        assert!(DOWN_SQL.contains("DROP COLUMN region"));
+    }
+}
diff --git a/apps/control-api/src/infra/database/migration/mod.rs b/apps/control-api/src/infra/database/migration/mod.rs
index 92afd63..7d17368 100644
--- a/apps/control-api/src/infra/database/migration/mod.rs
+++ b/apps/control-api/src/infra/database/migration/mod.rs
@@ -26,3 +26,4 @@ pub mod m20260806_000025_registration_allowlist;
 pub mod m20260807_000026_avatars;
 pub mod m20260807_000027_deployment_screenshots;
 pub mod m20260808_000028_object_storage;
+pub mod m20260908_000029_regional_routing;
diff --git a/apps/control-api/src/infra/http/middlewares/audit.rs b/apps/control-api/src/infra/http/middlewares/audit.rs
index d1db0c6..a6ee6f9 100644
--- a/apps/control-api/src/infra/http/middlewares/audit.rs
+++ b/apps/control-api/src/infra/http/middlewares/audit.rs
@@ -529,6 +529,7 @@ mod tests {
             id: deployment_id,
             project_id,
             team_id,
+            region: "default".to_owned(),
             build_node_id: None,
             serve_node_id: None,
             environment: DeploymentEnvironment::Production,
diff --git a/apps/control-api/src/infra/http/middlewares/node_auth.rs b/apps/control-api/src/infra/http/middlewares/node_auth.rs
index 870ed3e..b4943b1 100644
--- a/apps/control-api/src/infra/http/middlewares/node_auth.rs
+++ b/apps/control-api/src/infra/http/middlewares/node_auth.rs
@@ -154,6 +154,7 @@ mod tests {
         let node = crate::infra::database::entity::node::Model {
             id: uuid::Uuid::now_v7(),
             name: "disabled-node".to_owned(),
+            region: "default".to_owned(),
             token_hash: grass_token::hash_token(token),
             status: NodeStatus::Disabled,
             build_enabled: true,
diff --git a/apps/control-api/src/infra/node_manager/config_file.rs b/apps/control-api/src/infra/node_manager/config_file.rs
index 73da322..ccfd02e 100644
--- a/apps/control-api/src/infra/node_manager/config_file.rs
+++ b/apps/control-api/src/infra/node_manager/config_file.rs
@@ -14,6 +14,7 @@ const GENERATED_BY: &str = "grass-control-api";
 
 pub struct GenerateParams<'a> {
     pub node_name: &'a str,
+    pub region: &'a str,
     pub node_token: &'a str,
     pub control_api_url: String,
     pub storage_root: &'a str,
@@ -30,6 +31,7 @@ struct GeneratedConfig {
 #[derive(Serialize)]
 struct NodeSection {
     id: String,
+    region: String,
     control_api: String,
     node_token: String,
     work_root: String,
@@ -85,6 +87,7 @@ pub fn generate(path: &str, params: &GenerateParams<'_>) -> anyhow::Result<Vec<S
         generated_by: GENERATED_BY.to_owned(),
         node: NodeSection {
             id: params.node_name.to_owned(),
+            region: params.region.to_owned(),
             control_api: params.control_api_url.clone(),
             node_token: params.node_token.to_owned(),
             work_root: work_root.clone(),
@@ -232,6 +235,7 @@ mod tests {
         let storage = std::env::temp_dir().join("grass-node-config-storage-test");
         let params = GenerateParams {
             node_name: "local-node",
+            region: "default",
             node_token: "secret-token",
             control_api_url: "http://127.0.0.1:7817".to_owned(),
             storage_root: storage.to_str().unwrap(),
@@ -282,6 +286,7 @@ mod tests {
         let storage_new = std::env::temp_dir().join("grass-node-config-new-root");
         let params = GenerateParams {
             node_name: "local-node",
+            region: "default",
             node_token: "secret-token",
             control_api_url: "http://127.0.0.1:7817".to_owned(),
             storage_root: storage_old.to_str().unwrap(),
diff --git a/apps/node/Cargo.toml b/apps/node/Cargo.toml
index f34548e..f933be5 100644
--- a/apps/node/Cargo.toml
+++ b/apps/node/Cargo.toml
@@ -20,6 +20,7 @@ grass-git-source.workspace = true
 grass-node-protocol.workspace = true
 grass-validator.workspace = true
 hex.workspace = true
+hyper-util.workspace = true
 mime_guess.workspace = true
 sha2.workspace = true
 subtle = "2"
@@ -29,11 +30,20 @@ toml.workspace = true
 url.workspace = true
 walkdir.workspace = true
 reqwest.workspace = true
+rustls.workspace = true
+rustls-pemfile.workspace = true
+tempfile = "3"
 serde.workspace = true
 serde_json.workspace = true
 tokio-tungstenite.workspace = true
+tokio-rustls.workspace = true
 tokio = { workspace = true, features = ["fs", "io-std", "io-util", "macros", "process", "rt-multi-thread", "signal", "net", "sync", "time"] }
 tokio-util.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
 uuid.workspace = true
+x509-parser.workspace = true
+
+[dev-dependencies]
+rcgen = "0.14"
+time.workspace = true
diff --git a/apps/node/src/client/mod.rs b/apps/node/src/client/mod.rs
index 2e91b96..9b0027b 100644
--- a/apps/node/src/client/mod.rs
+++ b/apps/node/src/client/mod.rs
@@ -5,14 +5,15 @@ use std::{path::Path, time::Duration};
 use anyhow::Context;
 use futures_util::StreamExt;
 use grass_node_protocol::{
-    AppendBuildLogRequest, AppendBuildLogResponse, ClaimRequest, ClaimResponse,
-    ExchangePreviewCodeRequest, ExchangePreviewCodeResponse, HeartbeatRequest, HeartbeatResponse,
-    ObserveSshHostKeyRequest, ObserveSshHostKeyResponse, RedeemGitCredentialRequest,
-    RedeemGitCredentialResponse, RegisterRequest, RegisterResponse, ReportServeStatusRequest,
-    ReportServeStatusResponse, ResolveHostResponse, RouteSnapshotResponse, ServeAssignment,
-    ServeAssignmentsResponse, SsrLeaseResponse, StageRequest, StageResponse,
-    StartPreviewAuthorizationRequest, StartPreviewAuthorizationResponse, UploadArtifactResponse,
-    VerifyPreviewGrantRequest, VerifyPreviewGrantResponse, artifact_headers,
+    AppendBuildLogRequest, AppendBuildLogResponse, CertificateBundlesResponse, ClaimRequest,
+    ClaimResponse, ExchangePreviewCodeRequest, ExchangePreviewCodeResponse, HeartbeatRequest,
+    HeartbeatResponse, ObserveSshHostKeyRequest, ObserveSshHostKeyResponse,
+    RedeemGitCredentialRequest, RedeemGitCredentialResponse, RegisterRequest, RegisterResponse,
+    ReportIngressStatusRequest, ReportServeStatusRequest, ReportServeStatusResponse,
+    ResolveHostResponse, RouteSnapshotResponse, ServeAssignment, ServeAssignmentsResponse,
+    SsrLeaseResponse, StageRequest, StageResponse, StartPreviewAuthorizationRequest,
+    StartPreviewAuthorizationResponse, UploadArtifactResponse, VerifyPreviewGrantRequest,
+    VerifyPreviewGrantResponse, artifact_headers,
 };
 use serde::Deserialize;
 use serde::de::DeserializeOwned;
@@ -458,6 +459,38 @@ impl ControlApiClient {
             .map_err(RouteSnapshotError::Infrastructure)
     }
 
+    pub async fn certificate_bundles(
+        &self,
+    ) -> Result<CertificateBundlesResponse, RouteSnapshotError> {
+        let response = self
+            .http
+            .get(self.url("/serve/certificates"))
+            .bearer_auth(&self.token)
+            .send()
+            .await
+            .context("serve.certificates: request failed")
+            .map_err(RouteSnapshotError::Infrastructure)?;
+        if matches!(
+            response.status(),
+            reqwest::StatusCode::UNAUTHORIZED | reqwest::StatusCode::FORBIDDEN
+        ) {
+            return Err(RouteSnapshotError::AuthorizationRevoked);
+        }
+        Self::unwrap_envelope(response, "serve.certificates")
+            .await
+            .map_err(RouteSnapshotError::Infrastructure)
+    }
+
+    pub async fn report_ingress_status(
+        &self,
+        request: &ReportIngressStatusRequest,
+    ) -> anyhow::Result<()> {
+        let _: serde_json::Value = self
+            .post_json("/serve/ingress-status", request, "serve.ingress_status")
+            .await?;
+        Ok(())
+    }
+
     #[allow(dead_code)] // Wired by the serve resolver in Milestone 10.
     pub async fn resolve_host(&self, host: &str) -> anyhow::Result<Option<ResolveHostResponse>> {
         let response = self
diff --git a/apps/node/src/config.rs b/apps/node/src/config.rs
index ee6f2be..fb9f146 100644
--- a/apps/node/src/config.rs
+++ b/apps/node/src/config.rs
@@ -13,7 +13,7 @@ use grass_node_protocol::{
     NodeIdentityConfiguration, NodeLogConfiguration, NodeLogFormat,
     NodePrivateRepositoryTargetConfiguration, NodeRuntimeConfiguration,
     NodeRuntimeResourcesConfiguration, NodeSecurityConfiguration, NodeServeCapacityConfiguration,
-    NodeServeConfiguration, NodeSsrConfiguration,
+    NodeServeConfiguration, NodeSsrConfiguration, NodeTlsConfiguration,
 };
 use serde::{Deserialize, Serialize};
 use tracing_subscriber::{EnvFilter, fmt};
@@ -51,6 +51,8 @@ pub struct NodeIdentityConfig {
     pub control_api: String,
     #[serde(default = "default_node_token")]
     pub node_token: String,
+    #[serde(default = "default_node_region")]
+    pub region: String,
     #[serde(default = "default_node_work_root")]
     pub work_root: String,
     #[serde(default)]
@@ -63,6 +65,7 @@ impl Default for NodeIdentityConfig {
             id: default_node_id(),
             control_api: default_control_api(),
             node_token: default_node_token(),
+            region: default_node_region(),
             work_root: default_node_work_root(),
             capabilities: NodeCapabilitiesConfig::default(),
         }
@@ -122,6 +125,8 @@ pub struct ServeConfig {
     pub capacity: ServeCapacityConfig,
     #[serde(default)]
     pub ssr: SsrServeConfig,
+    #[serde(default)]
+    pub tls: NodeTlsConfiguration,
 }
 
 impl Default for ServeConfig {
@@ -134,6 +139,7 @@ impl Default for ServeConfig {
             artifact_cache_root: default_artifact_cache_root(),
             capacity: ServeCapacityConfig::default(),
             ssr: SsrServeConfig::default(),
+            tls: NodeTlsConfiguration::default(),
         }
     }
 }
@@ -306,6 +312,7 @@ impl NodeConfig {
                 id: self.node.id.clone(),
                 control_api: self.node.control_api.clone(),
                 work_root: self.node.work_root.clone(),
+                region: self.node.region.clone(),
                 capabilities: NodeCapabilities {
                     build: self.node.capabilities.build,
                     serve: self.node.capabilities.serve,
@@ -332,6 +339,7 @@ impl NodeConfig {
                     idle_stop_seconds: self.serve.ssr.idle_stop_seconds,
                     startup_timeout_seconds: self.serve.ssr.startup_timeout_seconds,
                 },
+                tls: self.serve.tls,
             },
             runtime: NodeRuntimeConfiguration {
                 backend: self.runtime.backend.clone(),
@@ -373,6 +381,7 @@ impl NodeConfig {
         self.node.id.clone_from(&desired.node.id);
         self.node.control_api.clone_from(&desired.node.control_api);
         self.node.work_root.clone_from(&desired.node.work_root);
+        self.node.region.clone_from(&desired.node.region);
         self.node.capabilities.build = desired.node.capabilities.build;
         self.node.capabilities.serve = desired.node.capabilities.serve;
         self.build.concurrency = desired.build.concurrency;
@@ -397,6 +406,7 @@ impl NodeConfig {
         self.serve.capacity.max_deployments = desired.serve.capacity.max_deployments;
         self.serve.ssr.idle_stop_seconds = desired.serve.ssr.idle_stop_seconds;
         self.serve.ssr.startup_timeout_seconds = desired.serve.ssr.startup_timeout_seconds;
+        self.serve.tls = desired.serve.tls;
         self.runtime.backend.clone_from(&desired.runtime.backend);
         self.runtime.socket.clone_from(&desired.runtime.socket);
         self.runtime
@@ -465,6 +475,8 @@ impl NodeConfig {
 
     pub fn validate(&self) -> anyhow::Result<()> {
         let capabilities = &self.node.capabilities;
+        grass_validator::normalize_region(&self.node.region)
+            .map_err(|error| anyhow::anyhow!("invalid node region: {error}"))?;
         if !capabilities.build && !capabilities.serve {
             anyhow::bail!("node must enable build or serve");
         }
@@ -472,6 +484,11 @@ impl NodeConfig {
             anyhow::bail!("build concurrency must be positive when build capability is enabled");
         }
         if capabilities.serve {
+            if self.serve.tls.enabled
+                && (self.serve.tls.port == 0 || self.serve.tls.port == self.serve.port)
+            {
+                anyhow::bail!("serve TLS port must be positive and different from the HTTP port");
+            }
             let base_url = url::Url::parse(&self.serve.public_base_url)
                 .context("serve public_base_url must be an absolute HTTP(S) URL")?;
             if !matches!(base_url.scheme(), "http" | "https") || !base_url.has_host() {
@@ -486,6 +503,7 @@ fn apply_env(config: &mut NodeConfig) -> Result<(), ConfigError> {
     overlay_string("GWNODE_ID", &mut config.node.id);
     overlay_string("GWNODE_CONTROL_API", &mut config.node.control_api);
     overlay_string("GWNODE_NODE_TOKEN", &mut config.node.node_token);
+    overlay_string("GWNODE_REGION", &mut config.node.region);
     overlay_string("GWNODE_WORK_ROOT", &mut config.node.work_root);
     overlay_u16("GWNODE_BUILD_CONCURRENCY", &mut config.build.concurrency)?;
     overlay_u64(
@@ -537,6 +555,10 @@ fn default_node_token() -> String {
     "change-me".to_owned()
 }
 
+fn default_node_region() -> String {
+    "default".to_owned()
+}
+
 fn default_node_work_root() -> String {
     "/data/node".to_owned()
 }
@@ -637,6 +659,25 @@ mod tests {
         assert!(parse_listen("GWNODE_SERVE_LISTEN", "localhost").is_err());
     }
 
+    #[test]
+    fn tls_defaults_preserve_existing_configs_and_reject_listener_conflicts() {
+        let legacy: NodeConfig = toml::from_str("[serve]\nport = 8080\n").unwrap();
+        assert!(!legacy.serve.tls.enabled);
+        assert_eq!(legacy.serve.tls.port, 8443);
+        let mut enabled: NodeConfig = toml::from_str("[serve.tls]\nenabled = true\n").unwrap();
+        assert!(enabled.serve.tls.enabled);
+        assert_eq!(enabled.serve.tls.port, 8443);
+        enabled.validate().unwrap();
+        let mut desired = enabled.sync_configuration();
+        desired.serve.tls.port = 9443;
+        enabled.apply_sync_configuration(&desired).unwrap();
+        assert_eq!(enabled.serve.tls.port, 9443);
+        enabled.serve.tls.port = enabled.serve.port;
+        assert!(enabled.validate().is_err());
+        enabled.serve.tls.port = 0;
+        assert!(enabled.validate().is_err());
+    }
+
     #[test]
     fn private_repository_exceptions_require_exact_host_ip_and_port() {
         let config: NodeConfig = toml::from_str(
diff --git a/apps/node/src/lifecycle.rs b/apps/node/src/lifecycle.rs
index ee6e675..3ff8a0d 100644
--- a/apps/node/src/lifecycle.rs
+++ b/apps/node/src/lifecycle.rs
@@ -53,6 +53,7 @@ pub fn registration_request(
             build: config.node.capabilities.build,
             serve: config.node.capabilities.serve,
         },
+        region: config.node.region.clone(),
         build_concurrency: if config.node.capabilities.build {
             config.build.concurrency
         } else {
diff --git a/apps/node/src/main.rs b/apps/node/src/main.rs
index cf124d2..73ea6ea 100644
--- a/apps/node/src/main.rs
+++ b/apps/node/src/main.rs
@@ -95,7 +95,11 @@ async fn main() -> anyhow::Result<()> {
         });
 
     let mut ssr_manager_for_shutdown = None;
-    let (artifact_sync, route_refresh, ssr_reaper, serve_task) = if config.node.capabilities.serve {
+    let (artifact_sync, route_refresh, certificate_sync, ssr_reaper, serve_task) = if config
+        .node
+        .capabilities
+        .serve
+    {
         let ssr_manager = Arc::new(serve::ssr::SsrManager::with_client(
             runtime,
             node_id,
@@ -125,14 +129,20 @@ async fn main() -> anyhow::Result<()> {
             client.clone(),
             std::path::PathBuf::from(&config.serve.artifact_cache_root),
         );
+        if let Err(error) = serve_state.ingress.restore().await {
+            tracing::warn!(operation = "node.serve.certificates.restore_failed", %error, "certificate cache could not be restored");
+        }
+        let certificate_sync =
+            serve::certificates::spawn(client.clone(), serve_state.ingress.clone());
         (
             Some(artifact_sync),
             Some(route_refresh),
+            Some(certificate_sync),
             Some(ssr_reaper),
             Some(serve::spawn(serve_state, &config)),
         )
     } else {
-        (None, None, None, None)
+        (None, None, None, None, None)
     };
 
     wait_for_shutdown().await;
@@ -146,6 +156,9 @@ async fn main() -> anyhow::Result<()> {
     if let Some(route_refresh) = route_refresh {
         route_refresh.abort();
     }
+    if let Some(certificate_sync) = certificate_sync {
+        certificate_sync.abort();
+    }
     if let Some(ssr_reaper) = ssr_reaper {
         ssr_reaper.abort();
     }
diff --git a/apps/node/src/serve/certificates.rs b/apps/node/src/serve/certificates.rs
new file mode 100644
index 0000000..4780157
--- /dev/null
+++ b/apps/node/src/serve/certificates.rs
@@ -0,0 +1,1187 @@
+//! Authoritative ingress snapshots, validated certificate cache and live SNI resolution.
+
+use std::collections::{HashMap, HashSet};
+use std::io::Cursor;
+use std::path::{Path, PathBuf};
+use std::sync::{
+    Arc, RwLock,
+    atomic::{AtomicBool, Ordering},
+};
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use anyhow::Context;
+use grass_node_protocol::{
+    CertificateBundle, CertificateBundlesResponse, HttpChallenge, InstalledCertificate,
+    ReportIngressStatusRequest,
+};
+use rustls::{
+    pki_types::ServerName,
+    server::{ClientHello, ResolvesServerCert},
+    sign::CertifiedKey,
+};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use tokio::io::AsyncWriteExt;
+use tracing::warn;
+use uuid::Uuid;
+
+use crate::{
+    client::{ControlApiClient, RouteSnapshotError},
+    config::NodeConfig,
+};
+
+const REFRESH_INTERVAL: Duration = Duration::from_secs(5);
+const MAX_ENTRIES: usize = 4096;
+const MAX_CERTIFICATE_BYTES: usize = 1024 * 1024;
+const MAX_PRIVATE_KEY_BYTES: usize = 64 * 1024;
+pub const CHALLENGE_PREFIX: &str = "/.well-known/acme-challenge/";
+
+#[derive(Clone)]
+struct LoadedCertificate {
+    bundle: CertificateBundle,
+    key: Arc<CertifiedKey>,
+    not_before: i64,
+    not_after: i64,
+}
+
+impl LoadedCertificate {
+    fn valid_at(&self, now: i64) -> bool {
+        self.not_before <= now && now < self.not_after
+    }
+}
+
+#[derive(Default)]
+struct Snapshot {
+    certificates: HashMap<String, LoadedCertificate>,
+    challenges: HashMap<(String, String), HttpChallenge>,
+    challenge_revision: String,
+}
+
+/// Debug intentionally excludes keys, certificates and HTTP challenge values.
+pub struct IngressState {
+    snapshot: RwLock<Snapshot>,
+    update: tokio::sync::Mutex<()>,
+    cache_path: PathBuf,
+    node_id: Uuid,
+    region: String,
+    tls_enabled: bool,
+    cache_dirty: AtomicBool,
+    pub http_ready: AtomicBool,
+    pub tls_ready: AtomicBool,
+}
+
+impl std::fmt::Debug for IngressState {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("IngressState")
+            .finish_non_exhaustive()
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+struct CachedCertificates {
+    node_id: Uuid,
+    region: String,
+    bundles: Vec<CertificateBundle>,
+}
+
+impl IngressState {
+    pub fn new(config: &NodeConfig, node_id: Uuid) -> Self {
+        Self {
+            snapshot: RwLock::new(Snapshot::default()),
+            update: tokio::sync::Mutex::new(()),
+            cache_path: Path::new(&config.serve.artifact_cache_root)
+                .join("certificates/active.json"),
+            node_id,
+            region: config.node.region.clone(),
+            tls_enabled: config.serve.tls.enabled,
+            cache_dirty: AtomicBool::new(true),
+            http_ready: AtomicBool::new(false),
+            tls_ready: AtomicBool::new(false),
+        }
+    }
+
+    /// Only a previously committed snapshot for this registered node and region
+    /// may be restored. Loose PEM files and stale temporary files are never used.
+    pub async fn restore(&self) -> anyhow::Result<()> {
+        let _update = self.update.lock().await;
+        let bytes = match tokio::fs::read(&self.cache_path).await {
+            Ok(bytes) => bytes,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+            Err(error) => return Err(error.into()),
+        };
+        let cached: CachedCertificates =
+            serde_json::from_slice(&bytes).context("invalid certificate cache")?;
+        if cached.node_id != self.node_id || cached.region != self.region {
+            return Ok(());
+        }
+        if cached.bundles.len() > MAX_ENTRIES {
+            anyhow::bail!("certificate cache exceeds the entry limit");
+        }
+        let now = unix_now();
+        let mut certificates = HashMap::new();
+        for bundle in cached.bundles {
+            if let Ok(certificate) = validate_bundle(bundle, now) {
+                certificates.insert(certificate.bundle.hostname.clone(), certificate);
+            }
+        }
+        self.snapshot
+            .write()
+            .expect("ingress state poisoned")
+            .certificates = certificates;
+        Ok(())
+    }
+
+    /// Apply a complete snapshot. Invalid replacements retain the same host's
+    /// previous valid certificate only when its opaque certificate ID matches.
+    /// Omissions revoke both live certificates and their persisted cache entry.
+    pub async fn apply(&self, response: CertificateBundlesResponse) -> anyhow::Result<()> {
+        self.apply_at(response, unix_now()).await
+    }
+
+    async fn apply_at(&self, response: CertificateBundlesResponse, now: i64) -> anyhow::Result<()> {
+        let _update = self.update.lock().await;
+        if response.bundles.len() > MAX_ENTRIES || response.challenges.len() > MAX_ENTRIES {
+            anyhow::bail!("ingress snapshot exceeds the entry limit");
+        }
+        let mut hosts = HashSet::new();
+        let mut identifiers = HashSet::new();
+        for bundle in &response.bundles {
+            let host = safe_hostname(&bundle.hostname)?;
+            if !hosts.insert(host) || !identifiers.insert(bundle.ingress_id) {
+                anyhow::bail!("ingress snapshot contains duplicate certificates");
+            }
+        }
+        let previous = self
+            .snapshot
+            .read()
+            .expect("ingress state poisoned")
+            .certificates
+            .clone();
+        let mut certificates = HashMap::new();
+        for bundle in response.bundles {
+            let host = safe_hostname(&bundle.hostname)?;
+            let ingress_id = bundle.ingress_id;
+            if let Some(certificate) = previous.get(&host).filter(|certificate| {
+                certificate.valid_at(now)
+                    && certificate.bundle.ingress_id == ingress_id
+                    && certificate.bundle.certificate_pem == bundle.certificate_pem
+                    && certificate.bundle.private_key_pem == bundle.private_key_pem
+                    && (bundle.revision.is_empty()
+                        || certificate.bundle.revision == bundle.revision)
+            }) {
+                certificates.insert(host, certificate.clone());
+                continue;
+            }
+            match validate_bundle(bundle, now) {
+                Ok(certificate) => {
+                    certificates.insert(host, certificate);
+                }
+                Err(error) => {
+                    warn!(operation = "node.serve.certificates.rejected", %ingress_id, %error, "certificate update rejected");
+                    if let Some(certificate) = previous.get(&host).filter(|certificate| {
+                        certificate.bundle.ingress_id == ingress_id && certificate.valid_at(now)
+                    }) {
+                        certificates.insert(host, certificate.clone());
+                    }
+                }
+            }
+        }
+        let (challenges, challenge_revision) = match validate_challenges(
+            response.challenges,
+            response.challenge_revision,
+            now,
+        ) {
+            Ok(challenges) => challenges,
+            Err(error) => {
+                warn!(operation = "node.serve.challenges.rejected", %error, "HTTP challenge snapshot rejected");
+                (HashMap::new(), String::new())
+            }
+        };
+        let cached = CachedCertificates {
+            node_id: self.node_id,
+            region: self.region.clone(),
+            bundles: certificates
+                .values()
+                .map(|certificate| certificate.bundle.clone())
+                .collect(),
+        };
+        let changed = certificates.len() != previous.len()
+            || certificates.iter().any(|(host, certificate)| {
+                previous.get(host).is_none_or(|old| {
+                    old.bundle.ingress_id != certificate.bundle.ingress_id
+                        || old.bundle.revision != certificate.bundle.revision
+                })
+            });
+        let persisted = if changed || self.cache_dirty.load(Ordering::Acquire) {
+            atomic_write(&self.cache_path, &serde_json::to_vec(&cached)?).await
+        } else {
+            Ok(())
+        };
+        self.cache_dirty
+            .store(persisted.is_err(), Ordering::Release);
+        // Memory still honors revocations when persistence fails. Remove the
+        // old cache so it cannot resurrect a revoked entry after a restart.
+        if persisted.is_err() {
+            match tokio::fs::remove_file(&self.cache_path).await {
+                Ok(()) => {}
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Err(error) => {
+                    warn!(operation = "node.serve.certificates.cache_remove_failed", %error, "failed to invalidate certificate cache after persistence failure")
+                }
+            }
+        }
+        *self.snapshot.write().expect("ingress state poisoned") = Snapshot {
+            certificates,
+            challenges,
+            challenge_revision,
+        };
+        persisted
+    }
+
+    pub fn status(&self) -> ReportIngressStatusRequest {
+        let snapshot = self.snapshot.read().expect("ingress state poisoned");
+        let now = unix_now();
+        let tls_ready = self.tls_enabled && self.tls_ready.load(Ordering::Acquire);
+        let mut certificates = if tls_ready {
+            snapshot
+                .certificates
+                .values()
+                .filter(|certificate| certificate.valid_at(now))
+                .map(|certificate| InstalledCertificate {
+                    ingress_id: certificate.bundle.ingress_id,
+                    revision: certificate.bundle.revision.clone(),
+                })
+                .collect::<Vec<_>>()
+        } else {
+            Vec::new()
+        };
+        certificates.sort_by_key(|certificate| certificate.ingress_id);
+        ReportIngressStatusRequest {
+            certificates,
+            challenge_revision: if self.http_ready.load(Ordering::Acquire)
+                && snapshot
+                    .challenges
+                    .values()
+                    .all(|challenge| challenge.expires_at_unix > now)
+            {
+                snapshot.challenge_revision.clone()
+            } else {
+                String::new()
+            },
+            tls_ready,
+        }
+    }
+
+    pub fn listeners_ready(&self) -> bool {
+        self.http_ready.load(Ordering::Acquire)
+            && (!self.tls_enabled || self.tls_ready.load(Ordering::Acquire))
+    }
+
+    pub fn certificate_for(&self, hostname: &str) -> Option<Arc<CertifiedKey>> {
+        self.snapshot
+            .read()
+            .expect("ingress state poisoned")
+            .certificates
+            .get(hostname)
+            .filter(|certificate| certificate.valid_at(unix_now()))
+            .map(|certificate| certificate.key.clone())
+    }
+
+    pub fn challenge(&self, hostname: &str, token: &str) -> Option<String> {
+        if !safe_token(token) {
+            return None;
+        }
+        self.snapshot
+            .read()
+            .expect("ingress state poisoned")
+            .challenges
+            .get(&(hostname.to_owned(), token.to_owned()))
+            .filter(|challenge| challenge.expires_at_unix > unix_now())
+            .map(|challenge| challenge.key_authorization.clone())
+    }
+}
+
+impl ResolvesServerCert for IngressState {
+    fn resolve(&self, hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>> {
+        let hostname = safe_hostname(hello.server_name()?).ok()?;
+        self.certificate_for(&hostname)
+    }
+}
+
+fn validate_bundle(mut bundle: CertificateBundle, now: i64) -> anyhow::Result<LoadedCertificate> {
+    bundle.hostname = safe_hostname(&bundle.hostname)?;
+    if bundle.certificate_pem.len() > MAX_CERTIFICATE_BYTES
+        || bundle.private_key_pem.len() > MAX_PRIVATE_KEY_BYTES
+    {
+        anyhow::bail!("certificate bundle exceeds the size limit");
+    }
+    let revision = hex::encode(Sha256::digest(bundle.certificate_pem.as_bytes()));
+    if !bundle.revision.is_empty() && bundle.revision != revision {
+        anyhow::bail!("certificate revision does not match certificate contents");
+    }
+    bundle.revision = revision;
+    let certificates = rustls_pemfile::certs(&mut Cursor::new(bundle.certificate_pem.as_bytes()))
+        .collect::<Result<Vec<_>, _>>()
+        .context("invalid certificate PEM")?;
+    if certificates.is_empty() || certificates.len() > 16 {
+        anyhow::bail!("invalid certificate chain length");
+    }
+    let private_key =
+        rustls_pemfile::private_key(&mut Cursor::new(bundle.private_key_pem.as_bytes()))
+            .context("invalid private key PEM")?
+            .context("certificate private key is missing")?;
+    let parsed = rustls::server::ParsedCertificate::try_from(&certificates[0])
+        .context("invalid leaf certificate")?;
+    let name =
+        ServerName::try_from(bundle.hostname.as_str()).context("invalid certificate DNS name")?;
+    rustls::client::verify_server_name(&parsed, &name)
+        .context("certificate does not cover its hostname")?;
+    let mut not_before = i64::MIN;
+    let mut not_after = i64::MAX;
+    for certificate in &certificates {
+        let (_, parsed) = x509_parser::parse_x509_certificate(certificate.as_ref())
+            .map_err(|_| anyhow::anyhow!("invalid certificate DER"))?;
+        not_before = not_before.max(parsed.validity().not_before.timestamp());
+        not_after = not_after.min(parsed.validity().not_after.timestamp());
+    }
+    if now < not_before || now >= not_after {
+        anyhow::bail!("certificate chain is not currently valid");
+    }
+    let key = CertifiedKey::from_der(
+        certificates,
+        private_key,
+        &rustls::crypto::ring::default_provider(),
+    )
+    .context("certificate private key does not match")?;
+    key.keys_match()
+        .context("certificate key match cannot be verified")?;
+    bundle.issued_at_unix = Some(not_before);
+    bundle.expires_at_unix = Some(not_after);
+    Ok(LoadedCertificate {
+        bundle,
+        key: Arc::new(key),
+        not_before,
+        not_after,
+    })
+}
+
+type ChallengeMap = HashMap<(String, String), HttpChallenge>;
+
+fn validate_challenges(
+    challenges: Vec<HttpChallenge>,
+    revision: String,
+    now: i64,
+) -> anyhow::Result<(ChallengeMap, String)> {
+    if revision.len() > 128
+        || !revision
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.'))
+        || (!challenges.is_empty() && revision.is_empty())
+    {
+        anyhow::bail!("invalid HTTP challenge revision");
+    }
+    let mut accepted = HashMap::new();
+    for mut challenge in challenges {
+        challenge.hostname = safe_hostname(&challenge.hostname)?;
+        let thumbprint = challenge
+            .key_authorization
+            .strip_prefix(&format!("{}.", challenge.token));
+        if !safe_token(&challenge.token)
+            || !thumbprint.is_some_and(|value| value.len() == 43 && safe_token(value))
+            || challenge.expires_at_unix <= now
+            || challenge.expires_at_unix > now.saturating_add(86400)
+        {
+            anyhow::bail!("invalid or expired HTTP challenge");
+        }
+        if accepted
+            .insert(
+                (challenge.hostname.clone(), challenge.token.clone()),
+                challenge,
+            )
+            .is_some()
+        {
+            anyhow::bail!("duplicate HTTP challenge");
+        }
+    }
+    Ok((accepted, revision))
+}
+
+fn safe_token(token: &str) -> bool {
+    !token.is_empty()
+        && token.len() <= 256
+        && token
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+}
+
+fn safe_hostname(hostname: &str) -> anyhow::Result<String> {
+    let normalized = grass_validator::normalize_host(hostname)
+        .map_err(|_| anyhow::anyhow!("invalid ingress hostname"))?;
+    if normalized.len() > 253
+        || !normalized
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-'))
+    {
+        anyhow::bail!("ingress hostname contains unsafe characters");
+    }
+    Ok(normalized)
+}
+
+fn unix_now() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+        .try_into()
+        .unwrap_or(i64::MAX)
+}
+
+async fn atomic_write(path: &Path, bytes: &[u8]) -> anyhow::Result<()> {
+    let directory = path.parent().context("certificate cache has no parent")?;
+    tokio::fs::create_dir_all(directory).await?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        tokio::fs::set_permissions(directory, std::fs::Permissions::from_mode(0o700)).await?;
+    }
+    let temporary = directory.join(format!("active-{}.tmp", Uuid::now_v7().simple()));
+    let result = async {
+        let mut options = tokio::fs::OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        options.mode(0o600);
+        let mut file = options.open(&temporary).await?;
+        file.write_all(bytes).await?;
+        file.sync_all().await?;
+        drop(file);
+        tokio::fs::rename(&temporary, path).await?;
+        Ok::<(), anyhow::Error>(())
+    }
+    .await;
+    if result.is_err() {
+        let _ = tokio::fs::remove_file(&temporary).await;
+    }
+    result
+}
+
+async fn refresh(client: &ControlApiClient, ingress: &IngressState) -> anyhow::Result<()> {
+    match client.certificate_bundles().await {
+        Ok(response) => ingress.apply(response).await?,
+        Err(RouteSnapshotError::AuthorizationRevoked) => {
+            ingress.apply(CertificateBundlesResponse::default()).await?;
+            anyhow::bail!("ingress authorization has been revoked");
+        }
+        Err(error) => return Err(error.into()),
+    }
+    client.report_ingress_status(&ingress.status()).await
+}
+
+pub fn spawn(client: ControlApiClient, ingress: Arc<IngressState>) -> tokio::task::JoinHandle<()> {
+    tokio::spawn(async move {
+        let mut interval = tokio::time::interval(REFRESH_INTERVAL);
+        interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        loop {
+            interval.tick().await;
+            if let Err(error) = refresh(&client, &ingress).await {
+                warn!(operation = "node.serve.certificates.refresh_failed", %error, "failed to synchronize ingress state");
+            }
+        }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use axum::{
+        Json, Router,
+        extract::State,
+        http::StatusCode,
+        routing::{get, post},
+    };
+    use grass_node_protocol::{RouteSnapshotResponse, ServeAccess, ServeResources, ServeRoute};
+    use rcgen::{CertificateParams, KeyPair};
+    use tokio::net::TcpListener;
+
+    use super::*;
+    use crate::serve::{
+        ResolvedTarget, ServeState, routes::RouteTable, serve_router, ssr::SsrManager, tls,
+    };
+
+    fn config(root: &Path) -> NodeConfig {
+        let mut config = NodeConfig::default();
+        config.serve.artifact_cache_root = root.display().to_string();
+        config.serve.tls.enabled = true;
+        config
+    }
+
+    fn bundle(host: &str, not_before: i64, not_after: i64) -> CertificateBundle {
+        let mut parameters = CertificateParams::new(vec![host.to_owned()]).unwrap();
+        parameters.not_before = time::OffsetDateTime::from_unix_timestamp(not_before).unwrap();
+        parameters.not_after = time::OffsetDateTime::from_unix_timestamp(not_after).unwrap();
+        let key = KeyPair::generate().unwrap();
+        let certificate = parameters.self_signed(&key).unwrap();
+        let pem = certificate.pem();
+        CertificateBundle {
+            ingress_id: Uuid::now_v7(),
+            hostname: host.to_owned(),
+            revision: hex::encode(Sha256::digest(pem.as_bytes())),
+            certificate_pem: pem,
+            private_key_pem: key.serialize_pem(),
+            // Deliberately false metadata: validation must use certificate DER.
+            issued_at_unix: Some(0),
+            expires_at_unix: Some(i64::MAX),
+        }
+    }
+
+    fn valid_bundle(host: &str) -> CertificateBundle {
+        let now = unix_now();
+        bundle(host, now - 60, now + 3600)
+    }
+
+    fn snapshot(bundles: Vec<CertificateBundle>) -> CertificateBundlesResponse {
+        CertificateBundlesResponse {
+            bundles,
+            ..Default::default()
+        }
+    }
+
+    fn challenge(host: &str) -> HttpChallenge {
+        HttpChallenge {
+            hostname: host.to_owned(),
+            token: "test-token_123".to_owned(),
+            key_authorization: format!("test-token_123.{}", "A".repeat(43)),
+            expires_at_unix: unix_now() + 300,
+        }
+    }
+
+    #[test]
+    fn certificate_validation_checks_real_validity_names_key_and_revision() {
+        let now = unix_now();
+        let original = bundle("edge.example.test", now - 60, now + 300);
+        let loaded = validate_bundle(original.clone(), now).unwrap();
+        assert_eq!(loaded.bundle.expires_at_unix, Some(now + 300));
+        assert_eq!(loaded.bundle.issued_at_unix, Some(now - 60));
+        assert!(!format!("{original:?}").contains("PRIVATE KEY"));
+        assert!(!format!("{original:?}").contains(&original.private_key_pem));
+
+        let mut wrong_name = original.clone();
+        wrong_name.hostname = "another.example.test".to_owned();
+        assert!(validate_bundle(wrong_name, now).is_err());
+        let mut wrong_key = original.clone();
+        wrong_key.private_key_pem = KeyPair::generate().unwrap().serialize_pem();
+        assert!(validate_bundle(wrong_key, now).is_err());
+        let mut wrong_revision = original.clone();
+        wrong_revision.revision = "a".repeat(64);
+        assert!(validate_bundle(wrong_revision, now).is_err());
+        assert!(validate_bundle(bundle("edge.example.test", now - 120, now - 1), now).is_err());
+        assert!(validate_bundle(bundle("edge.example.test", now + 60, now + 300), now).is_err());
+        assert!(validate_bundle(original, now + 300).is_err());
+        assert!(safe_hostname("../secret").is_err());
+    }
+
+    #[tokio::test]
+    async fn invalid_renewal_retains_only_the_same_valid_certificate_identity() {
+        let root = tempfile::tempdir().unwrap();
+        let state = IngressState::new(&config(root.path()), Uuid::now_v7());
+        state.tls_ready.store(true, Ordering::Release);
+        let original = valid_bundle("edge.example.test");
+        state.apply(snapshot(vec![original.clone()])).await.unwrap();
+        let mut invalid = original.clone();
+        invalid.certificate_pem = "invalid PEM".to_owned();
+        invalid.revision = "bad".to_owned();
+        state.apply(snapshot(vec![invalid.clone()])).await.unwrap();
+        assert_eq!(state.status().certificates[0].revision, original.revision);
+
+        // Reassignment of the hostname to a different certificate owner cannot
+        // accidentally keep the previous owner's certificate live.
+        invalid.ingress_id = Uuid::now_v7();
+        state.apply(snapshot(vec![invalid])).await.unwrap();
+        assert!(state.certificate_for("edge.example.test").is_none());
+        assert!(state.status().certificates.is_empty());
+    }
+
+    #[tokio::test]
+    async fn expired_certificates_cannot_be_selected_or_retained_on_failed_renewal() {
+        let root = tempfile::tempdir().unwrap();
+        let state = IngressState::new(&config(root.path()), Uuid::now_v7());
+        state.tls_ready.store(true, Ordering::Release);
+        let now = unix_now();
+        let expired = bundle("expired.example.test", now - 300, now - 1);
+        state
+            .apply_at(snapshot(vec![expired.clone()]), now - 120)
+            .await
+            .unwrap();
+        assert!(state.certificate_for("expired.example.test").is_none());
+        assert!(state.status().certificates.is_empty());
+        let mut invalid = expired;
+        invalid.private_key_pem = "broken".to_owned();
+        state.apply(snapshot(vec![invalid])).await.unwrap();
+        assert!(state.snapshot.read().unwrap().certificates.is_empty());
+    }
+
+    #[tokio::test]
+    async fn cache_restarts_preserve_valid_certificates_without_resurrecting_withdrawals() {
+        let root = tempfile::tempdir().unwrap();
+        let config = config(root.path());
+        let node_id = Uuid::now_v7();
+        let state = IngressState::new(&config, node_id);
+        state
+            .apply(snapshot(vec![valid_bundle("edge.example.test")]))
+            .await
+            .unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(
+                tokio::fs::metadata(&state.cache_path)
+                    .await
+                    .unwrap()
+                    .permissions()
+                    .mode()
+                    & 0o777,
+                0o600
+            );
+            assert_eq!(
+                tokio::fs::metadata(state.cache_path.parent().unwrap())
+                    .await
+                    .unwrap()
+                    .permissions()
+                    .mode()
+                    & 0o777,
+                0o700
+            );
+        }
+        let restored = IngressState::new(&config, node_id);
+        restored.restore().await.unwrap();
+        assert!(restored.certificate_for("edge.example.test").is_some());
+        let different_node = IngressState::new(&config, Uuid::now_v7());
+        different_node.restore().await.unwrap();
+        assert!(
+            different_node
+                .certificate_for("edge.example.test")
+                .is_none()
+        );
+        let mut different_region_config = config.clone();
+        different_region_config.node.region = "another".to_owned();
+        let different_region = IngressState::new(&different_region_config, node_id);
+        different_region.restore().await.unwrap();
+        assert!(
+            different_region
+                .certificate_for("edge.example.test")
+                .is_none()
+        );
+
+        state.apply(snapshot(Vec::new())).await.unwrap();
+        let after_withdrawal = IngressState::new(&config, node_id);
+        after_withdrawal.restore().await.unwrap();
+        assert!(
+            after_withdrawal
+                .certificate_for("edge.example.test")
+                .is_none()
+        );
+        assert!(
+            !tokio::fs::read_to_string(&state.cache_path)
+                .await
+                .unwrap()
+                .contains("PRIVATE KEY")
+        );
+
+        // A cached certificate that expired while the Node was offline is not
+        // revived, even if supplied metadata still claims distant expiry.
+        let now = unix_now();
+        state
+            .apply_at(
+                snapshot(vec![bundle("edge.example.test", now - 300, now - 1)]),
+                now - 120,
+            )
+            .await
+            .unwrap();
+        let expired_restart = IngressState::new(&config, node_id);
+        expired_restart.restore().await.unwrap();
+        assert!(
+            expired_restart
+                .certificate_for("edge.example.test")
+                .is_none()
+        );
+    }
+
+    #[tokio::test]
+    async fn challenge_snapshots_are_exact_scoped_expiring_and_acknowledged_only_when_serving() {
+        let root = tempfile::tempdir().unwrap();
+        let state = IngressState::new(&config(root.path()), Uuid::now_v7());
+        let original = challenge("Edge.Example.test");
+        let response = CertificateBundlesResponse {
+            challenges: vec![original.clone()],
+            challenge_revision: "revision-1".to_owned(),
+            ..Default::default()
+        };
+        state.apply(response.clone()).await.unwrap();
+        assert!(state.status().challenge_revision.is_empty());
+        state.http_ready.store(true, Ordering::Release);
+        assert_eq!(state.status().challenge_revision, "revision-1");
+        assert_eq!(
+            state.challenge("edge.example.test", &original.token),
+            Some(original.key_authorization)
+        );
+        assert!(
+            state
+                .challenge("other.example.test", &original.token)
+                .is_none()
+        );
+        for token in [
+            "../test-token_123",
+            "test-token_123/extra",
+            "%74est-token_123",
+            "wrong",
+        ] {
+            assert!(state.challenge("edge.example.test", token).is_none());
+        }
+
+        let mut expired = response.clone();
+        expired.challenges[0].expires_at_unix = unix_now() - 1;
+        state.apply(expired).await.unwrap();
+        assert!(
+            state
+                .challenge("edge.example.test", "test-token_123")
+                .is_none()
+        );
+        assert!(state.status().challenge_revision.is_empty());
+        state.apply(response).await.unwrap();
+        state
+            .apply(CertificateBundlesResponse {
+                challenge_revision: "revision-empty".to_owned(),
+                ..Default::default()
+            })
+            .await
+            .unwrap();
+        assert!(
+            state
+                .challenge("edge.example.test", "test-token_123")
+                .is_none()
+        );
+        assert_eq!(state.status().challenge_revision, "revision-empty");
+    }
+
+    async fn serve_state(root: &Path) -> Arc<ServeState> {
+        let config = config(root);
+        let node_id = Uuid::now_v7();
+        let routes = Arc::new(RouteTable::default());
+        routes
+            .apply(RouteSnapshotResponse {
+                revision: "ready".to_owned(),
+                routes: Vec::new(),
+            })
+            .await
+            .unwrap();
+        let client = ControlApiClient::new("http://127.0.0.1:1", "test-token").unwrap();
+        let ssr = Arc::new(SsrManager::with_client(
+            None,
+            node_id,
+            &config,
+            client.clone(),
+        ));
+        let state = Arc::new(ServeState::new(
+            client,
+            node_id,
+            "gateway-test-token".to_owned(),
+            routes,
+            &config,
+            ssr,
+        ));
+        state.ingress.http_ready.store(true, Ordering::Release);
+        state.ingress.tls_ready.store(true, Ordering::Release);
+        state
+    }
+
+    struct ServerTask(tokio::task::JoinHandle<()>);
+
+    impl Drop for ServerTask {
+        fn drop(&mut self) {
+            self.0.abort();
+        }
+    }
+
+    fn https_client(
+        address: std::net::SocketAddr,
+        bundles: &[CertificateBundle],
+    ) -> reqwest::Client {
+        let mut builder = reqwest::Client::builder()
+            .no_proxy()
+            .tls_info(true)
+            .http1_only()
+            .pool_max_idle_per_host(0)
+            .timeout(Duration::from_secs(3));
+        for bundle in bundles {
+            builder = builder
+                .add_root_certificate(
+                    reqwest::Certificate::from_pem(bundle.certificate_pem.as_bytes()).unwrap(),
+                )
+                .resolve(&bundle.hostname, address);
+        }
+        builder
+            .resolve("unknown.example.test", address)
+            .build()
+            .unwrap()
+    }
+
+    #[tokio::test]
+    async fn real_https_serves_sites_rejects_sni_host_confusion_and_hot_swaps_certificates() {
+        let root = tempfile::tempdir().unwrap();
+        let state = serve_state(root.path()).await;
+        let first = valid_bundle("a.example.test");
+        let second_host = valid_bundle("b.example.test");
+        state
+            .ingress
+            .apply(snapshot(vec![first.clone(), second_host.clone()]))
+            .await
+            .unwrap();
+        let mut routes = Vec::new();
+        for (host, text) in [
+            ("a.example.test", "tenant A"),
+            ("b.example.test", "tenant B"),
+        ] {
+            let deployment_id = Uuid::now_v7();
+            let directory = root.path().join(host);
+            tokio::fs::create_dir(&directory).await.unwrap();
+            tokio::fs::write(directory.join("index.html"), text)
+                .await
+                .unwrap();
+            state.targets.lock().await.insert(
+                deployment_id,
+                ResolvedTarget::Static {
+                    static_dir: directory,
+                    spa_fallback: false,
+                    not_found: None,
+                },
+            );
+            routes.push(ServeRoute {
+                host: host.to_owned(),
+                region: "default".to_owned(),
+                deployment_id,
+                target_node_id: state.node_id,
+                target_base_url: "http://127.0.0.1:1".to_owned(),
+                resources: ServeResources {
+                    cpu_millicores: 50,
+                    memory_mb: 64,
+                    disk_mb: 128,
+                },
+                access: ServeAccess::Public,
+            });
+        }
+        state
+            .routes
+            .apply(RouteSnapshotResponse {
+                revision: "sites".to_owned(),
+                routes,
+            })
+            .await
+            .unwrap();
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let app = serve_router(state.clone());
+        let ingress = state.ingress.clone();
+        let _server = ServerTask(tokio::spawn(async move {
+            tls::serve(listener, app, ingress).await.unwrap();
+        }));
+        let client = https_client(address, &[first.clone(), second_host.clone()]);
+        let response = client
+            .get(format!("https://a.example.test:{}/", address.port()))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        let first_der = response
+            .extensions()
+            .get::<reqwest::tls::TlsInfo>()
+            .unwrap()
+            .peer_certificate()
+            .unwrap()
+            .to_vec();
+        assert_eq!(response.text().await.unwrap(), "tenant A");
+        let mismatched = client
+            .get(format!("https://a.example.test:{}/", address.port()))
+            .header("host", "b.example.test")
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(mismatched.status(), StatusCode::MISDIRECTED_REQUEST);
+        assert!(
+            client
+                .get(format!("https://unknown.example.test:{}/", address.port()))
+                .send()
+                .await
+                .is_err()
+        );
+
+        let mut renewed = valid_bundle("a.example.test");
+        renewed.ingress_id = first.ingress_id;
+        state
+            .ingress
+            .apply(snapshot(vec![renewed.clone(), second_host.clone()]))
+            .await
+            .unwrap();
+        let renewed_client = https_client(address, &[renewed.clone(), second_host.clone()]);
+        let response = renewed_client
+            .get(format!("https://a.example.test:{}/", address.port()))
+            .send()
+            .await
+            .unwrap();
+        let renewed_der = response
+            .extensions()
+            .get::<reqwest::tls::TlsInfo>()
+            .unwrap()
+            .peer_certificate()
+            .unwrap();
+        assert_ne!(renewed_der, first_der);
+        assert_eq!(response.text().await.unwrap(), "tenant A");
+        assert!(
+            state
+                .ingress
+                .status()
+                .certificates
+                .iter()
+                .any(|certificate| certificate.revision == renewed.revision)
+        );
+
+        let mut broken = renewed.clone();
+        broken.private_key_pem = "bad private key".to_owned();
+        state
+            .ingress
+            .apply(snapshot(vec![broken, second_host.clone()]))
+            .await
+            .unwrap();
+        let preserved = renewed_client
+            .get(format!("https://a.example.test:{}/", address.port()))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(preserved.status(), StatusCode::OK);
+        assert_eq!(
+            state
+                .ingress
+                .status()
+                .certificates
+                .iter()
+                .find(|certificate| certificate.ingress_id == first.ingress_id)
+                .unwrap()
+                .revision,
+            renewed.revision
+        );
+
+        state
+            .ingress
+            .apply(snapshot(vec![second_host]))
+            .await
+            .unwrap();
+        assert!(
+            renewed_client
+                .get(format!("https://a.example.test:{}/", address.port()))
+                .send()
+                .await
+                .is_err()
+        );
+        let still_serving = renewed_client
+            .get(format!("https://b.example.test:{}/", address.port()))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(still_serving.text().await.unwrap(), "tenant B");
+    }
+
+    #[tokio::test]
+    async fn http_health_and_challenges_work_without_a_deployment_and_never_bypass_other_hosts() {
+        let root = tempfile::tempdir().unwrap();
+        let state = serve_state(root.path()).await;
+        let challenge = challenge("edge.example.test");
+        state
+            .ingress
+            .apply(CertificateBundlesResponse {
+                challenges: vec![challenge.clone()],
+                challenge_revision: "revision-1".to_owned(),
+                ..Default::default()
+            })
+            .await
+            .unwrap();
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let app = serve_router(state.clone());
+        let _server = ServerTask(tokio::spawn(async move {
+            axum::serve(
+                listener,
+                app.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+            )
+            .await
+            .unwrap();
+        }));
+        let client = reqwest::Client::builder().no_proxy().build().unwrap();
+        let base = format!("http://{address}");
+        let health = client
+            .get(format!("{base}/_grass/health"))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(health.status(), StatusCode::OK);
+        state.ingress.tls_ready.store(false, Ordering::Release);
+        assert_eq!(
+            client
+                .get(format!("{base}/_grass/health"))
+                .send()
+                .await
+                .unwrap()
+                .status(),
+            StatusCode::SERVICE_UNAVAILABLE
+        );
+        let challenge_url = format!("{base}{CHALLENGE_PREFIX}{}", challenge.token);
+        let response = client
+            .get(&challenge_url)
+            .header("host", "EDGE.EXAMPLE.TEST:80")
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response.text().await.unwrap(), challenge.key_authorization);
+        assert_eq!(
+            client
+                .get(&challenge_url)
+                .header("host", "another.example.test")
+                .send()
+                .await
+                .unwrap()
+                .status(),
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(
+            client
+                .post(&challenge_url)
+                .header("host", "edge.example.test")
+                .send()
+                .await
+                .unwrap()
+                .status(),
+            StatusCode::METHOD_NOT_ALLOWED
+        );
+        assert_eq!(
+            client
+                .get(format!("{base}/"))
+                .header("host", "edge.example.test")
+                .send()
+                .await
+                .unwrap()
+                .status(),
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(
+            client
+                .get(format!("{base}{CHALLENGE_PREFIX}%74est-token_123"))
+                .header("host", "edge.example.test")
+                .send()
+                .await
+                .unwrap()
+                .status(),
+            StatusCode::NOT_FOUND
+        );
+        state
+            .ingress
+            .apply(CertificateBundlesResponse::default())
+            .await
+            .unwrap();
+        assert_eq!(
+            client
+                .get(&challenge_url)
+                .header("host", "edge.example.test")
+                .send()
+                .await
+                .unwrap()
+                .status(),
+            StatusCode::NOT_FOUND
+        );
+    }
+
+    #[derive(Clone)]
+    struct MockControl {
+        response: Arc<tokio::sync::RwLock<(StatusCode, CertificateBundlesResponse)>>,
+        reports: Arc<tokio::sync::Mutex<Vec<ReportIngressStatusRequest>>>,
+    }
+
+    async fn control_snapshot(
+        State(state): State<MockControl>,
+    ) -> impl axum::response::IntoResponse {
+        let response = state.response.read().await;
+        (
+            response.0,
+            Json(
+                serde_json::json!({ "code": response.0.as_u16(), "message": "snapshot", "data": response.1 }),
+            ),
+        )
+    }
+
+    async fn control_report(
+        State(state): State<MockControl>,
+        Json(report): Json<ReportIngressStatusRequest>,
+    ) -> Json<serde_json::Value> {
+        state.reports.lock().await.push(report);
+        Json(serde_json::json!({ "code": 200, "message": "ok", "data": { "acknowledged": true } }))
+    }
+
+    #[tokio::test]
+    async fn synchronization_preserves_outages_distinguishes_revocation_and_reports_loaded_state() {
+        let root = tempfile::tempdir().unwrap();
+        let ingress = IngressState::new(&config(root.path()), Uuid::now_v7());
+        ingress.http_ready.store(true, Ordering::Release);
+        ingress.tls_ready.store(true, Ordering::Release);
+        let control = MockControl {
+            response: Arc::new(tokio::sync::RwLock::new((
+                StatusCode::OK,
+                CertificateBundlesResponse {
+                    bundles: vec![valid_bundle("edge.example.test")],
+                    challenges: vec![challenge("edge.example.test")],
+                    challenge_revision: "revision-1".to_owned(),
+                },
+            ))),
+            reports: Arc::new(tokio::sync::Mutex::new(Vec::new())),
+        };
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let client = ControlApiClient::new(
+            &format!("http://{}", listener.local_addr().unwrap()),
+            "node-test-token",
+        )
+        .unwrap();
+        let app = Router::new()
+            .route("/api/v1/internal/serve/certificates", get(control_snapshot))
+            .route(
+                "/api/v1/internal/serve/ingress-status",
+                post(control_report),
+            )
+            .with_state(control.clone());
+        let _server = ServerTask(tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        }));
+        refresh(&client, &ingress).await.unwrap();
+        let reports = control.reports.lock().await;
+        assert_eq!(reports.len(), 1);
+        assert_eq!(reports[0].certificates.len(), 1);
+        assert_eq!(reports[0].challenge_revision, "revision-1");
+        assert!(reports[0].tls_ready);
+        drop(reports);
+        control.response.write().await.0 = StatusCode::SERVICE_UNAVAILABLE;
+        assert!(refresh(&client, &ingress).await.is_err());
+        assert!(ingress.certificate_for("edge.example.test").is_some());
+        assert!(
+            ingress
+                .challenge("edge.example.test", "test-token_123")
+                .is_some()
+        );
+        assert_eq!(control.reports.lock().await.len(), 1);
+        control.response.write().await.0 = StatusCode::UNAUTHORIZED;
+        assert!(refresh(&client, &ingress).await.is_err());
+        assert!(ingress.certificate_for("edge.example.test").is_none());
+        assert!(
+            ingress
+                .challenge("edge.example.test", "test-token_123")
+                .is_none()
+        );
+        let restarted = IngressState::new(&config(root.path()), ingress.node_id);
+        restarted.restore().await.unwrap();
+        assert!(restarted.certificate_for("edge.example.test").is_none());
+    }
+}
diff --git a/apps/node/src/serve/mod.rs b/apps/node/src/serve/mod.rs
index 1d86e05..19b383c 100644
--- a/apps/node/src/serve/mod.rs
+++ b/apps/node/src/serve/mod.rs
@@ -6,15 +6,18 @@
 //! outputs use strict path normalization, while SSR outputs are proxied to a
 //! deployment service container started on demand by [`ssr::SsrManager`].
 
+pub mod certificates;
 pub mod routes;
 pub mod ssr;
 pub mod static_files;
 pub mod sync;
+pub mod tls;
 
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
+use std::sync::atomic::Ordering;
 use std::time::{Duration, Instant};
 
 use axum::{
@@ -22,8 +25,9 @@ use axum::{
     body::Body,
     extract::{ConnectInfo, Request, State},
     http::{HeaderMap, HeaderName, HeaderValue, StatusCode, header},
+    middleware::{self, Next},
     response::{IntoResponse, Response},
-    routing::{any, post},
+    routing::{any, get, post},
 };
 use grass_node_protocol::{ServeAccess, ServeRoute};
 use serde::Deserialize;
@@ -70,6 +74,7 @@ pub struct ServeState {
     /// Proxy client for peer Nodes and SSR upstreams: connect timeout only,
     /// so streamed responses are never cut off by a total timeout.
     proxy: reqwest::Client,
+    pub ingress: Arc<certificates::IngressState>,
 }
 
 impl ServeState {
@@ -93,6 +98,7 @@ impl ServeState {
             ),
             preview_grants: Mutex::new(HashMap::new()),
             ssr,
+            ingress: Arc::new(certificates::IngressState::new(config, node_id)),
             proxy: reqwest::Client::builder()
                 .connect_timeout(Duration::from_secs(5))
                 .build()
@@ -103,13 +109,98 @@ impl ServeState {
 
 fn serve_router(state: Arc<ServeState>) -> axum::Router {
     axum::Router::new()
+        .route("/_grass/health", get(health))
         .route(ROUTE_INVALIDATION_PATH, post(invalidate_routes))
         .route(PEER_PROXY_PREFIX, any(handle_peer_proxy))
+        .route("/_grass/internal/proxy/", any(handle_peer_proxy))
         .route("/_grass/internal/proxy/{*path}", any(handle_peer_proxy))
         .fallback(route_public_request)
+        .layer(middleware::from_fn_with_state(
+            state.clone(),
+            ingress_request,
+        ))
         .with_state(state)
 }
 
+async fn health(State(state): State<Arc<ServeState>>) -> Response {
+    let ready = state.ingress.listeners_ready() && state.routes.revision().await.is_some();
+    (
+        if ready {
+            StatusCode::OK
+        } else {
+            StatusCode::SERVICE_UNAVAILABLE
+        },
+        Json(serde_json::json!({ "ready": ready })),
+    )
+        .into_response()
+}
+
+/// Handles the two reserved public ingress endpoints before Host deployment
+/// resolution. HTTPS still requires exact agreement between SNI and HTTP Host.
+async fn ingress_request(
+    State(state): State<Arc<ServeState>>,
+    mut request: Request,
+    next: Next,
+) -> Response {
+    if let Some(authority) = request.uri().authority() {
+        let Ok(authority_host) = grass_validator::normalize_host(authority.host()) else {
+            return StatusCode::BAD_REQUEST.into_response();
+        };
+        if request.headers().contains_key(header::HOST) {
+            if host_from_headers(request.headers()).as_deref() != Some(authority_host.as_str()) {
+                return StatusCode::MISDIRECTED_REQUEST.into_response();
+            }
+        } else {
+            let Ok(value) = HeaderValue::from_str(authority.as_str()) else {
+                return StatusCode::BAD_REQUEST.into_response();
+            };
+            request.headers_mut().insert(header::HOST, value);
+        }
+    }
+    if let Some(connection) = request.extensions().get::<tls::TlsConnection>() {
+        let sni = grass_validator::normalize_host(&connection.server_name).ok();
+        if sni.is_none()
+            || host_from_headers(request.headers()) != sni
+            || !sni
+                .as_deref()
+                .is_some_and(|hostname| state.ingress.certificate_for(hostname).is_some())
+        {
+            return StatusCode::MISDIRECTED_REQUEST.into_response();
+        }
+    }
+    if let Some(token) = request
+        .uri()
+        .path()
+        .strip_prefix(certificates::CHALLENGE_PREFIX)
+    {
+        if !matches!(
+            *request.method(),
+            axum::http::Method::GET | axum::http::Method::HEAD
+        ) {
+            return StatusCode::METHOD_NOT_ALLOWED.into_response();
+        }
+        let Some(host) = host_from_headers(request.headers()) else {
+            return StatusCode::BAD_REQUEST.into_response();
+        };
+        let Some(authorization) = state.ingress.challenge(&host, token) else {
+            return StatusCode::NOT_FOUND.into_response();
+        };
+        return (
+            [
+                (header::CONTENT_TYPE, "text/plain"),
+                (header::CACHE_CONTROL, "no-store"),
+            ],
+            if request.method() == axum::http::Method::HEAD {
+                String::new()
+            } else {
+                authorization
+            },
+        )
+            .into_response();
+    }
+    next.run(request).await
+}
+
 #[derive(Deserialize)]
 struct RouteInvalidationRequest {
     deployment_id: Uuid,
@@ -153,8 +244,13 @@ async fn invalidate_routes(
 
 pub fn spawn(state: Arc<ServeState>, config: &NodeConfig) -> tokio::task::JoinHandle<()> {
     let addr = std::net::SocketAddr::new(config.serve.host, config.serve.port);
+    let tls_addr = config
+        .serve
+        .tls
+        .enabled
+        .then(|| std::net::SocketAddr::new(config.serve.host, config.serve.tls.port));
     tokio::spawn(async move {
-        let app = serve_router(state);
+        let app = serve_router(state.clone());
         let listener = match tokio::net::TcpListener::bind(addr).await {
             Ok(listener) => listener,
             Err(error) => {
@@ -162,13 +258,39 @@ pub fn spawn(state: Arc<ServeState>, config: &NodeConfig) -> tokio::task::JoinHa
                 return;
             }
         };
+        let tls_listener = match tls_addr {
+            Some(addr) => match tokio::net::TcpListener::bind(addr).await {
+                Ok(listener) => Some(listener),
+                Err(error) => {
+                    warn!(operation = "node.serve.tls.bind", %error, %addr, "HTTPS listener bind failed");
+                    return;
+                }
+            },
+            None => None,
+        };
+        state.ingress.http_ready.store(true, Ordering::Release);
+        state
+            .ingress
+            .tls_ready
+            .store(tls_listener.is_some(), Ordering::Release);
         info!(operation = "node.serve.start", %addr, "public serve listener started");
-        if let Err(error) = axum::serve(
+        let http = axum::serve(
             listener,
-            app.into_make_service_with_connect_info::<SocketAddr>(),
-        )
-        .await
-        {
+            app.clone()
+                .into_make_service_with_connect_info::<SocketAddr>(),
+        );
+        let result = if let Some(listener) = tls_listener {
+            info!(operation = "node.serve.tls.start", addr = ?tls_addr, "HTTPS listener started");
+            tokio::select! {
+                result = std::future::IntoFuture::into_future(http) => result.map_err(anyhow::Error::from),
+                result = tls::serve(listener, app, state.ingress.clone()) => result,
+            }
+        } else {
+            http.await.map_err(anyhow::Error::from)
+        };
+        state.ingress.http_ready.store(false, Ordering::Release);
+        state.ingress.tls_ready.store(false, Ordering::Release);
+        if let Err(error) = result {
             warn!(operation = "node.serve.stopped", %error, "serve listener stopped");
         }
     })
@@ -334,6 +456,9 @@ fn route_action(
 }
 
 fn host_from_headers(headers: &HeaderMap) -> Option<String> {
+    if headers.get_all(header::HOST).iter().count() != 1 {
+        return None;
+    }
     let raw = headers.get(header::HOST)?.to_str().ok()?;
     let without_port = raw.rsplit_once(':').map_or(raw, |(host, port)| {
         if port.chars().all(|character| character.is_ascii_digit()) {
@@ -886,7 +1011,14 @@ async fn forward_to_ssr(
     }
     if matches!(origin, GatewayOrigin::External) {
         builder = builder
-            .header("x-forwarded-proto", "http")
+            .header(
+                "x-forwarded-proto",
+                if parts.extensions.get::<tls::TlsConnection>().is_some() {
+                    "https"
+                } else {
+                    "http"
+                },
+            )
             .header("x-forwarded-for", client_addr.ip().to_string());
         if let Some(host) = parts.headers.get(header::HOST) {
             builder = builder.header("x-forwarded-host", host);
@@ -934,7 +1066,14 @@ async fn forward_to_gateway(
         .header(GATEWAY_TOKEN_HEADER, gateway_token)
         .header(GATEWAY_HOP_HEADER, "1")
         .header("x-forwarded-for", client_addr.ip().to_string())
-        .header("x-forwarded-proto", "http");
+        .header(
+            "x-forwarded-proto",
+            if parts.extensions.get::<tls::TlsConnection>().is_some() {
+                "https"
+            } else {
+                "http"
+            },
+        );
     if let Some(host) = parts.headers.get(header::HOST) {
         builder = builder.header("x-forwarded-host", host);
     }
@@ -1404,6 +1543,7 @@ mod tests {
                 revision: "before-withdrawal".to_owned(),
                 routes: vec![ServeRoute {
                     host: "app.example.com".to_owned(),
+                    region: "default".to_owned(),
                     deployment_id,
                     target_node_id: Uuid::now_v7(),
                     target_base_url: format!("http://{authority_address}"),
diff --git a/apps/node/src/serve/release_smoke.rs b/apps/node/src/serve/release_smoke.rs
index a184129..9449b57 100644
--- a/apps/node/src/serve/release_smoke.rs
+++ b/apps/node/src/serve/release_smoke.rs
@@ -332,6 +332,7 @@ async fn checks_out_builds_packages_stages_and_serves_vite() -> anyhow::Result<(
             revision: "release-smoke-v1".to_owned(),
             routes: vec![ServeRoute {
                 host: FIXTURE_HOST.to_owned(),
+                region: "default".to_owned(),
                 deployment_id,
                 target_node_id: node_id,
                 target_base_url: "http://127.0.0.1:1".to_owned(),
diff --git a/apps/node/src/serve/routes.rs b/apps/node/src/serve/routes.rs
index f460c5b..eba5e2f 100644
--- a/apps/node/src/serve/routes.rs
+++ b/apps/node/src/serve/routes.rs
@@ -168,6 +168,7 @@ mod tests {
     fn route(host: &str, deployment_id: Uuid) -> ServeRoute {
         ServeRoute {
             host: host.to_owned(),
+            region: "default".to_owned(),
             deployment_id,
             target_node_id: Uuid::now_v7(),
             target_base_url: "http://node-a:8080".to_owned(),
diff --git a/apps/node/src/serve/tls.rs b/apps/node/src/serve/tls.rs
new file mode 100644
index 0000000..f08f815
--- /dev/null
+++ b/apps/node/src/serve/tls.rs
@@ -0,0 +1,291 @@
+//! Native HTTPS listener with dynamic SNI certificates and connection metadata.
+
+use std::{sync::Arc, time::Duration};
+
+use axum::{Extension, extract::ConnectInfo};
+use hyper_util::{
+    rt::{TokioExecutor, TokioIo, TokioTimer},
+    server::conn::auto::Builder,
+    service::TowerToHyperService,
+};
+use tokio::{net::TcpListener, sync::Semaphore, task::JoinSet};
+use tokio_rustls::TlsAcceptor;
+
+use super::certificates::IngressState;
+
+/// This extension is created from the TLS connection, never from HTTP headers.
+#[derive(Clone)]
+pub struct TlsConnection {
+    pub server_name: String,
+}
+
+pub fn configuration(ingress: Arc<IngressState>) -> anyhow::Result<Arc<rustls::ServerConfig>> {
+    let mut config = rustls::ServerConfig::builder_with_provider(Arc::new(
+        rustls::crypto::ring::default_provider(),
+    ))
+    .with_safe_default_protocol_versions()?
+    .with_no_client_auth()
+    .with_cert_resolver(ingress);
+    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+    // Every new connection must resolve the current certificate, including
+    // after a host has been revoked or its previous certificate has expired.
+    config.session_storage = Arc::new(rustls::server::NoServerSessionStorage {});
+    config.send_tls13_tickets = 0;
+    Ok(Arc::new(config))
+}
+
+pub async fn serve(
+    listener: TcpListener,
+    app: axum::Router,
+    ingress: Arc<IngressState>,
+) -> anyhow::Result<()> {
+    let acceptor = TlsAcceptor::from(configuration(ingress)?);
+    let permits = Arc::new(Semaphore::new(4096));
+    // Dropping the parent listener task also aborts all of its connections.
+    let mut connections = JoinSet::new();
+    loop {
+        tokio::select! {
+            connection = listener.accept() => {
+                let (stream, address) = connection?;
+                let Ok(permit) = permits.clone().try_acquire_owned() else { continue; };
+                let acceptor = acceptor.clone();
+                let app = app.clone();
+                connections.spawn(async move {
+                    let _permit = permit;
+                    let Ok(Ok(stream)) = tokio::time::timeout(Duration::from_secs(10), acceptor.accept(stream)).await else { return; };
+                    let Some(server_name) = stream.get_ref().1.server_name().map(str::to_owned) else { return; };
+                    let service = TowerToHyperService::new(app
+                        .layer(Extension(ConnectInfo(address)))
+                        .layer(Extension(TlsConnection { server_name })));
+                    let mut builder = Builder::new(TokioExecutor::new());
+                    builder.http1().timer(TokioTimer::new()).header_read_timeout(Duration::from_secs(15));
+                    if let Err(error) = builder.serve_connection_with_upgrades(TokioIo::new(stream), service).await {
+                        tracing::debug!(operation = "node.serve.tls.connection", %error, "HTTPS connection closed");
+                    }
+                });
+            }
+            _ = connections.join_next(), if !connections.is_empty() => {}
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        net::SocketAddr,
+        path::Path,
+        sync::atomic::{AtomicUsize, Ordering},
+    };
+
+    use grass_node_protocol::{
+        CertificateBundle, CertificateBundlesResponse, RouteSnapshotResponse, ServeAccess,
+        ServeResources, ServeRoute,
+    };
+    use uuid::Uuid;
+
+    use super::*;
+    use crate::{
+        client::ControlApiClient,
+        config::NodeConfig,
+        serve::{ResolvedTarget, ServeState, routes::RouteTable, serve_router, ssr::SsrManager},
+    };
+
+    struct ServerTask(tokio::task::JoinHandle<()>);
+
+    impl Drop for ServerTask {
+        fn drop(&mut self) {
+            self.0.abort();
+        }
+    }
+
+    async fn node(
+        root: &Path,
+        node_id: Uuid,
+        region: &str,
+        route: ServeRoute,
+        tls_enabled: bool,
+    ) -> Arc<ServeState> {
+        let mut config = NodeConfig::default();
+        config.node.region = region.to_owned();
+        config.serve.tls.enabled = tls_enabled;
+        config.serve.artifact_cache_root = root.join(node_id.to_string()).display().to_string();
+        let client = ControlApiClient::new("http://127.0.0.1:1", "test-node-token").unwrap();
+        let routes = Arc::new(RouteTable::default());
+        routes
+            .apply(RouteSnapshotResponse {
+                revision: "full-regional-snapshot".to_owned(),
+                routes: vec![route],
+            })
+            .await
+            .unwrap();
+        let manager = Arc::new(SsrManager::with_client(
+            None,
+            node_id,
+            &config,
+            client.clone(),
+        ));
+        let state = Arc::new(ServeState::new(
+            client,
+            node_id,
+            "shared-test-gateway-token".to_owned(),
+            routes,
+            &config,
+            manager,
+        ));
+        state.ingress.http_ready.store(true, Ordering::Release);
+        state
+            .ingress
+            .tls_ready
+            .store(tls_enabled, Ordering::Release);
+        state
+    }
+
+    async fn entry(
+        state: Arc<ServeState>,
+        certificate: CertificateBundle,
+    ) -> (SocketAddr, ServerTask) {
+        state
+            .ingress
+            .apply(CertificateBundlesResponse {
+                bundles: vec![certificate],
+                ..Default::default()
+            })
+            .await
+            .unwrap();
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let task = tokio::spawn(async move {
+            serve(listener, serve_router(state.clone()), state.ingress.clone())
+                .await
+                .unwrap();
+        });
+        (address, ServerTask(task))
+    }
+
+    /// A loopback TCP frontend exercises passthrough and connection failover,
+    /// without depending on an external load-balancer process or a real CA.
+    async fn frontend(
+        backends: [SocketAddr; 2],
+        selected: Arc<AtomicUsize>,
+    ) -> (SocketAddr, ServerTask) {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let task = tokio::spawn(async move {
+            let mut connections = JoinSet::new();
+            loop {
+                tokio::select! {
+                    connection = listener.accept() => {
+                        let (mut downstream, _) = connection.unwrap();
+                        let selected = selected.clone();
+                        connections.spawn(async move {
+                            for (index, backend) in backends.into_iter().enumerate() {
+                                if let Ok(Ok(mut upstream)) = tokio::time::timeout(Duration::from_millis(500), tokio::net::TcpStream::connect(backend)).await {
+                                    selected.store(index, Ordering::Release);
+                                    let _ = tokio::io::copy_bidirectional(&mut downstream, &mut upstream).await;
+                                    break;
+                                }
+                            }
+                        });
+                    }
+                    _ = connections.join_next(), if !connections.is_empty() => {}
+                }
+            }
+        });
+        (address, ServerTask(task))
+    }
+
+    #[tokio::test]
+    async fn surviving_tls_entry_keeps_serving_a_deployment_in_another_region() {
+        const HOST: &str = "site.example.test";
+        let root = tempfile::tempdir().unwrap();
+        let deployment_id = Uuid::now_v7();
+        let target_id = Uuid::now_v7();
+        let target_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let route = ServeRoute {
+            host: HOST.to_owned(),
+            region: "us".to_owned(),
+            deployment_id,
+            target_node_id: target_id,
+            target_base_url: format!("http://{}", target_listener.local_addr().unwrap()),
+            resources: ServeResources {
+                cpu_millicores: 50,
+                memory_mb: 64,
+                disk_mb: 128,
+            },
+            access: ServeAccess::Public,
+        };
+        let target = node(root.path(), target_id, "us", route.clone(), false).await;
+        let artifact = root.path().join("site-artifact");
+        tokio::fs::create_dir(&artifact).await.unwrap();
+        tokio::fs::write(
+            artifact.join("index.html"),
+            "deployment stays on its original US Serve Node",
+        )
+        .await
+        .unwrap();
+        target.targets.lock().await.insert(
+            deployment_id,
+            ResolvedTarget::Static {
+                static_dir: artifact,
+                spa_fallback: false,
+                not_found: None,
+            },
+        );
+        let _target_task = ServerTask(tokio::spawn(async move {
+            axum::serve(
+                target_listener,
+                serve_router(target).into_make_service_with_connect_info::<SocketAddr>(),
+            )
+            .await
+            .unwrap();
+        }));
+        let generated = rcgen::generate_simple_self_signed(vec![HOST.to_owned()]).unwrap();
+        let certificate = CertificateBundle {
+            ingress_id: Uuid::now_v7(),
+            hostname: HOST.to_owned(),
+            certificate_pem: generated.cert.pem(),
+            private_key_pem: generated.signing_key.serialize_pem(),
+            issued_at_unix: None,
+            expires_at_unix: None,
+            revision: String::new(),
+        };
+        let a = node(root.path(), Uuid::now_v7(), "eu", route.clone(), true).await;
+        let b = node(root.path(), Uuid::now_v7(), "eu", route, true).await;
+        let (a_address, a_task) = entry(a, certificate.clone()).await;
+        let (b_address, _b_task) = entry(b, certificate.clone()).await;
+        let selected = Arc::new(AtomicUsize::new(usize::MAX));
+        let (frontend_address, _frontend_task) =
+            frontend([a_address, b_address], selected.clone()).await;
+        let client = reqwest::Client::builder()
+            .no_proxy()
+            .add_root_certificate(
+                reqwest::Certificate::from_pem(certificate.certificate_pem.as_bytes()).unwrap(),
+            )
+            .resolve(HOST, frontend_address)
+            .pool_max_idle_per_host(0)
+            .timeout(Duration::from_secs(3))
+            .build()
+            .unwrap();
+        let url = format!("https://{HOST}:{}/", frontend_address.port());
+        let initial = client.get(&url).send().await.unwrap();
+        assert_eq!(initial.status(), axum::http::StatusCode::OK);
+        assert_eq!(
+            initial.text().await.unwrap(),
+            "deployment stays on its original US Serve Node"
+        );
+        assert_eq!(selected.load(Ordering::Acquire), 0);
+
+        a_task.0.abort();
+        // Await termination so the first TLS listener and its active connection
+        // tasks have been dropped before the next client connection is opened.
+        let mut a_task = a_task;
+        let _ = (&mut a_task.0).await;
+        let after_failure = client.get(&url).send().await.unwrap();
+        assert_eq!(after_failure.status(), axum::http::StatusCode::OK);
+        assert_eq!(
+            after_failure.text().await.unwrap(),
+            "deployment stays on its original US Serve Node"
+        );
+        assert_eq!(selected.load(Ordering::Acquire), 1);
+    }
+}
diff --git a/crates/node-protocol/src/lib.rs b/crates/node-protocol/src/lib.rs
index 4e2f13a..1bf63e8 100644
--- a/crates/node-protocol/src/lib.rs
+++ b/crates/node-protocol/src/lib.rs
@@ -51,6 +51,8 @@ pub struct NodeIdentityConfiguration {
     pub id: String,
     pub control_api: String,
     pub work_root: String,
+    #[serde(default = "default_region")]
+    pub region: String,
     pub capabilities: NodeCapabilities,
 }
 
@@ -70,6 +72,24 @@ pub struct NodeServeConfiguration {
     pub artifact_cache_root: String,
     pub capacity: NodeServeCapacityConfiguration,
     pub ssr: NodeSsrConfiguration,
+    #[serde(default)]
+    pub tls: NodeTlsConfiguration,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct NodeTlsConfiguration {
+    pub enabled: bool,
+    pub port: u16,
+}
+
+impl Default for NodeTlsConfiguration {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            port: 8443,
+        }
+    }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -144,6 +164,8 @@ pub struct RegisterRequest {
     pub name: String,
     pub version: String,
     pub capabilities: NodeCapabilities,
+    #[serde(default = "default_region")]
+    pub region: String,
     pub build_concurrency: u16,
     /// Public base URL of the Node serve listener, when known.
     #[serde(default)]
@@ -434,6 +456,8 @@ pub struct SsrLeaseResponse {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServeRoute {
     pub host: String,
+    #[serde(default = "default_region")]
+    pub region: String,
     pub deployment_id: Uuid,
     pub target_node_id: Uuid,
     pub target_base_url: String,
@@ -447,6 +471,68 @@ pub struct RouteSnapshotResponse {
     pub routes: Vec<ServeRoute>,
 }
 
+/// A certificate bundle that a Serve Node may install for a regional ingress.
+/// Private key material is sent only over the authenticated internal protocol.
+#[derive(Clone, Serialize, Deserialize)]
+pub struct CertificateBundle {
+    pub ingress_id: Uuid,
+    pub hostname: String,
+    pub certificate_pem: String,
+    pub private_key_pem: String,
+    pub issued_at_unix: Option<i64>,
+    #[serde(default)]
+    pub revision: String,
+    #[serde(default)]
+    pub expires_at_unix: Option<i64>,
+}
+
+impl std::fmt::Debug for CertificateBundle {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("CertificateBundle")
+            .field("ingress_id", &self.ingress_id)
+            .field("hostname", &self.hostname)
+            .field("revision", &self.revision)
+            .field("issued_at_unix", &self.issued_at_unix)
+            .field("expires_at_unix", &self.expires_at_unix)
+            .finish_non_exhaustive()
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct CertificateBundlesResponse {
+    pub bundles: Vec<CertificateBundle>,
+    #[serde(default)]
+    pub challenges: Vec<HttpChallenge>,
+    #[serde(default)]
+    pub challenge_revision: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct HttpChallenge {
+    pub hostname: String,
+    pub token: String,
+    pub key_authorization: String,
+    pub expires_at_unix: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InstalledCertificate {
+    pub ingress_id: Uuid,
+    pub revision: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReportIngressStatusRequest {
+    pub certificates: Vec<InstalledCertificate>,
+    pub challenge_revision: String,
+    pub tls_ready: bool,
+}
+
+fn default_region() -> String {
+    "default".to_owned()
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ResolveHostResponse {
     pub deployment_id: Uuid,
@@ -715,6 +801,7 @@ mod tests {
 
         let route = ServeRoute {
             host: "app.example.com".to_owned(),
+            region: "eu-west".to_owned(),
             deployment_id: Uuid::nil(),
             target_node_id: Uuid::nil(),
             target_base_url: "http://node-1:8080".to_owned(),
@@ -724,6 +811,7 @@ mod tests {
         let parsed: ServeRoute =
             serde_json::from_slice(&serde_json::to_vec(&route).unwrap()).unwrap();
         assert_eq!(parsed.host, "app.example.com");
+        assert_eq!(parsed.region, "eu-west");
         assert_eq!(parsed.resources, resources);
         assert_eq!(parsed.access, ServeAccess::TeamOrPlatformAdmin);
     }
diff --git a/crates/validator/src/lib.rs b/crates/validator/src/lib.rs
index cca2086..ca6b7bb 100644
--- a/crates/validator/src/lib.rs
+++ b/crates/validator/src/lib.rs
@@ -87,6 +87,14 @@ pub fn normalize_slug(value: &str) -> Result<String, SlugError> {
     Ok(normalized)
 }
 
+pub fn normalize_region(value: &str) -> Result<String, SlugError> {
+    let normalized = normalize_slug(value)?;
+    if normalized.len() > 64 {
+        return Err(SlugError::TooLong);
+    }
+    Ok(normalized)
+}
+
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
 pub enum HostError {
     Empty,
@@ -194,6 +202,12 @@ mod tests {
         );
     }
 
+    #[test]
+    fn normalizes_regions_with_a_stable_short_slug() {
+        assert_eq!(normalize_region(" EU_West 1 ").unwrap(), "eu-west-1");
+        assert_eq!(normalize_region(&"a".repeat(65)), Err(SlugError::TooLong));
+    }
+
     #[test]
     fn rejects_empty_invalid_and_oversized_slugs() {
         assert_eq!(normalize_slug("---"), Err(SlugError::Empty));
diff --git a/deploy/haproxy-regional.cfg b/deploy/haproxy-regional.cfg
new file mode 100644
index 0000000..3a04a81
--- /dev/null
+++ b/deploy/haproxy-regional.cfg
@@ -0,0 +1,45 @@
+# HAProxy 2.8+: replace documentation addresses/hostname before deployment.
+# Validate with: haproxy -c -f deploy/haproxy-regional.cfg
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log global
+    timeout connect 5s
+    timeout client 60s
+    timeout server 60s
+    timeout tunnel 1h
+
+frontend regional_http
+    bind :80
+    mode http
+    # Public HTTP serves ACME challenges and sites, never internal Node APIs.
+    http-request deny if { path_beg /_grass/internal/ }
+    default_backend regional_http_nodes
+
+backend regional_http_nodes
+    mode http
+    balance roundrobin
+    option httpchk
+    http-check send meth GET uri /_grass/health ver HTTP/1.1 hdr Host eu.entry.example.net
+    http-check expect status 200
+    server entry_a 192.0.2.11:8080 check inter 2s fall 2 rise 2
+    server entry_b 192.0.2.12:8080 check inter 2s fall 2 rise 2
+
+frontend regional_https
+    bind :443
+    mode tcp
+    default_backend regional_https_nodes
+
+backend regional_https_nodes
+    mode tcp
+    balance roundrobin
+    # HTTPS is passed through unchanged, including the original SNI and Host.
+    # Probe the separate HTTP listener; do not send plaintext to port 8443.
+    option httpchk
+    http-check connect port 8080
+    http-check send meth GET uri /_grass/health ver HTTP/1.1 hdr Host eu.entry.example.net
+    http-check expect status 200
+    server entry_a 192.0.2.11:8443 check inter 2s fall 2 rise 2
+    server entry_b 192.0.2.12:8443 check inter 2s fall 2 rise 2
diff --git a/docs/regional-ingress.md b/docs/regional-ingress.md
new file mode 100644
index 0000000..2b2f0a7
--- /dev/null
+++ b/docs/regional-ingress.md
@@ -0,0 +1,217 @@
+# Regional ingress and HTTPS
+
+A regional ingress gives custom domains one stable CNAME target. Each entry
+Node uses the client's original Host to look up the deployment in its full
+route snapshot. A request reaches its assigned Serve Node through at most one
+Peer Hop, including when that deployment lives in another region.
+
+## Configure the entry Nodes
+
+Use at least two Serve Nodes in the same region. Configure a distinct Node
+identity and private `public_base_url` on each; the values below are examples.
+
+```toml
+[node]
+id = "eu-entry-a"
+region = "eu"
+
+[node.capabilities]
+build = false
+serve = true
+
+[serve]
+host = "0.0.0.0"
+port = 8080
+public_base_url = "http://eu-entry-a.internal:8080"
+artifact_cache_root = "/data/node/artifacts"
+
+[serve.tls]
+enabled = true
+port = 8443
+```
+
+Merge these settings into the Node configuration containing its Control API
+URL and Node token. TLS defaults to disabled on port `8443` for compatibility
+with existing configurations. A configured TLS port must be nonzero and
+different from the HTTP port. The Console's Node configuration editor also
+exposes native HTTPS and its port; restart the Node after applying desired
+configuration and confirm the effective revision and TLS readiness.
+
+The HTTP listener remains available for HTTP-01 and internal communication.
+Keep its address reachable from the Control API, the regional load balancer,
+and every Serve Node that may forward traffic. Use private networking or a
+Tailscale/WireGuard network for these addresses. A Node endpoint URL is not a
+site URL: native HTTPS rejects requests whose TLS SNI differs from the site
+Host, so use private HTTP for `serve.public_base_url` when enabling native TLS.
+
+### Gateway authentication and mixed Nodes
+
+Gateway token authentication is the default. A Serve Node registered with the
+Control API receives the outbound credential through its authenticated Node
+session; it is not placed in desired configuration. On a Node whose Serve
+listeners are reachable only by trusted peers, the inbound mode can be changed:
+
+```toml
+[security]
+gateway_authentication = "none"
+```
+
+The sender follows the target Node's advertised mode. A target using `token`
+receives the gateway token even if the sending Node accepts `none`; a target
+using `none` receives the single-hop marker without a token. All four source
+and target mode combinations therefore work. Missing credentials for a token
+target produce an error rather than falling back to unauthenticated traffic.
+
+Every mode retains Host binding and the one-hop limit. The Control API's Node
+endpoints continue to require the individual Node bearer token. Use token
+mode for public entry Nodes, including TLS entry listeners: TCP passthrough
+cannot filter an encrypted request for an internal gateway path. Token
+authentication does not encrypt private HTTP traffic; use an encrypted mesh
+when the transport network is not trusted.
+
+## Configure the regional load balancer
+
+[deploy/haproxy-regional.cfg](../deploy/haproxy-regional.cfg) is a HAProxy
+2.8+ example with HTTP on port 80 and TCP passthrough on port 443. Replace its
+documentation IP addresses and the regional hostname with your deployment
+values. Keep TLS termination on the Nodes so every custom hostname receives
+its own matching certificate; the CNAME target's certificate does not cover
+the custom domain.
+
+```sh
+haproxy -c -f deploy/haproxy-regional.cfg
+haproxy -W -db -f deploy/haproxy-regional.cfg
+```
+
+The example preserves the incoming Host and TLS SNI. It does not use PROXY
+protocol, which the Node listener does not accept; Nodes therefore see the
+load balancer's source IP. Do not add `send-proxy` to the backend servers.
+Firewall backend ports so only the load balancer and trusted internal clients
+can reach them. Public entry Nodes should keep token gateway authentication.
+
+Both backends check `GET /_grass/health` over each Node's HTTP port. This
+reserved endpoint works without a deployment binding and reports readiness
+after the route snapshot and configured listeners are available. Use the same
+path in **Administration → Regional ingresses**. Certificate installation and
+Node TLS readiness are shown separately in the ingress status.
+
+Point the ingress hostname's A/AAAA records at the load balancer. A DNS record
+listing several Node addresses is not a substitute for health-based removal:
+clients may keep a failed address until its cached DNS answer expires. The
+example removes an unhealthy entry after two failed checks and admits it
+again after two successful checks. Existing connections to an entry that
+fails must reconnect; new requests use an available entry.
+
+## Bind and verify a custom hostname
+
+1. Under **Administration → Regional ingresses**, add the Node region and an
+   ingress hostname such as `eu.entry.example.net`. Enable the ingress and TLS,
+   select the certificate issuer, and configure its DNS challenge provider.
+2. Add the custom domain in the project's Domains page and select that region.
+   Publish the displayed CNAME target and the exact `_grass.<domain>` TXT
+   ownership record. The TXT value is bound to this domain binding; copy the
+   Console value rather than deriving or reusing one from another binding.
+3. Run ownership verification. The binding must also pass the configured
+   automatic or manual domain review policy before it serves traffic or
+   becomes eligible for certificate issuance.
+4. Keep public TCP port 80 reachable through every entry for HTTP-01. The Node
+   serves only the published host/token challenge while it is unexpired,
+   even before a deployment is active. Ordinary requests still require a
+   Host binding and an active deployment.
+5. Wait for the certificate to become active and the entry Nodes to report its
+   installed revision, then open the custom HTTPS URL.
+
+The Control API waits for healthy regional entries to acknowledge the current
+HTTP challenge snapshot before it asks the CA to validate the challenge. Each
+Node polls snapshots every five seconds. An unreachable Control API preserves
+the last valid local certificate; explicit Node authorization revocation or
+an authoritative snapshot removing the hostname withdraws it.
+
+If public port 80 cannot be exposed, select DNS-01 for the custom domain and
+publish the displayed `_acme-challenge.<domain>` CNAME delegation. Its target
+is specific to the binding under the regional ingress hostname. The Control
+API verifies that delegation, creates the TXT value through the configured
+regional DNS provider, waits for public DNS propagation, and removes that
+exact value after the attempt. Preserve the delegation for automatic renewal;
+update it if the regional ingress hostname changes. HTTP-01 and delegated
+DNS-01 both require the independent `_grass` TXT ownership verification.
+
+## Issuers and renewal
+
+- **Let's Encrypt:** automatic issuance and renewal. Regional ingress
+  hostnames use DNS-01; custom domains default to HTTP-01 and can use the
+  delegated DNS-01 flow above. `contact_email` is optional account contact
+  configuration.
+- **ZeroSSL:** uses the same lifecycle and also requires `eab_kid` and the
+  base64/base64url `eab_hmac_key` in the regional account configuration.
+- **Manual:** import a full certificate chain and matching private key through
+  the ingress or custom-domain certificate controls. Replace it by importing
+  a renewed bundle before expiry; manual certificates are not auto-renewed.
+
+Automatic renewal starts within 30 days of the effective certificate-chain
+expiry. The backend records attempt state, a retry delay, expiry and sanitized
+failure details. The Console can request issuance or renewal and display the
+retry state. While a renewal fails, Nodes retain a still-valid certificate for
+the same hostname and certificate identity. Certificate/key mismatches,
+hostname mismatches and expired chains are rejected before activation.
+
+Certificates hot-reload without restarting the Node. The private cache under
+`serve.artifact_cache_root/certificates` is restored only for the same Node and
+region and contains only validated certificate snapshots. Back it up with the
+same access restrictions as other private keys. Challenges are not restored
+from the certificate cache. Removing a binding or disabling an ingress/TLS
+withdraws its certificates and challenges on the next successful snapshot.
+
+For staging tests, operators may set `GRASS_ACME_DIRECTORY_URL` on the Control
+API to the test CA's directory URL before creating fresh test certificate
+accounts. Existing persisted ACME accounts retain their original directory.
+Use dedicated test domains, provider credentials and a disposable approved
+database; production CA rate limits apply to ordinary production issuance.
+
+## DNS provider configuration
+
+Regional DNS credentials are write-only and encrypted using the platform
+secret. Keep that secret backed up. Empty credential fields preserve saved
+values; a JSON `null` removes a field. Host sources use the same providers for
+ordinary A/AAAA/CNAME provisioning, while regional certificates create TXT
+challenges separately.
+
+| Provider | Regional challenge configuration | Required DNS access |
+| --- | --- | --- |
+| Cloudflare | `api_token`, `zone_id`, `zone` | Read the selected zone's records and create/delete challenge TXT records |
+| DNSPod | `secret_id`, `secret_key`, `domain`; optional `record_line` | Describe, create, modify and delete records in the selected Tencent Cloud DNSPod domain |
+| Route53 | `access_key_id`, `secret_access_key`, `hosted_zone_id`, `zone`; optional signing `region` | `route53:ListResourceRecordSets` and `route53:ChangeResourceRecordSets` for the selected hosted zone |
+
+For a host source also set `record_type` (`A`, `AAAA`, or `CNAME`) and
+`record_value`; `ttl` is optional. Enter Route53 zone IDs as `Z…` or
+`/hostedzone/Z…`. Its signing region defaults to `us-east-1`.
+
+Route53 updates use atomic `DELETE` and `CREATE` changes to preserve concurrent
+TXT values and avoid overwriting a record set changed by another writer.
+IAM policies restricting `route53:ChangeResourceRecordSetsActions` must allow
+both `CREATE` and `DELETE`; permission restricted to `UPSERT` is insufficient.
+Restrict record names/types and the hosted zone ARN according to the DNS
+records this deployment manages. Existing TXT values unrelated to the current
+challenge are retained.
+
+## Verify entry failover
+
+Check the reserved health endpoint on each private HTTP address, confirm both
+entry Nodes have the custom-domain certificate revision, and request the site
+through the load balancer:
+
+```sh
+curl --fail http://eu-entry-a.internal:8080/_grass/health
+curl --fail http://eu-entry-b.internal:8080/_grass/health
+curl --fail https://www.example.org/
+```
+
+In a test environment, disable one entry backend in HAProxy or stop that entry
+Node, wait for the health checks to remove it, and repeat the HTTPS request
+using a fresh connection. Restore the entry and confirm it is admitted again.
+Place the test deployment on a separate healthy Serve Node to verify the
+remaining entry can still Peer Hop to it, including across regions.
+
+This checks entry availability while the assigned deployment Node stays
+healthy. Automatic relocation of artifacts when the assigned Serve Node
+fails belongs to the separate Serve failover scope.
diff --git a/docs/self-hosting.md b/docs/self-hosting.md
index 4e1eff8..47db73c 100644
--- a/docs/self-hosting.md
+++ b/docs/self-hosting.md
@@ -266,6 +266,12 @@ socket = "unix:///run/user/1000/podman/podman.sock"
 default_build_image = "docker.io/library/node:22"
 ```
 
+Nodes are assigned to the `default` region unless `node.region` (or
+`GWNODE_REGION`) is set to another region slug. Deployments can request a
+region and the scheduler will only place them on healthy Serve Nodes in that
+region. Keep the same region on every Node that should accept those
+deployments.
+
 ```sh
 just run node         # or: grass-node --config node.toml
 ```
@@ -312,6 +318,12 @@ machine:
 public_base_url = "http://serve-a.internal:8080"
 ```
 
+For public HTTPS, enable the Node's native TLS listener and put the regional
+load balancer in TCP passthrough mode. Keep `serve.public_base_url` on private
+HTTP: it addresses the Node for Peer Hop requests, whose Host belongs to the
+site. See [Regional ingress and HTTPS](regional-ingress.md) for complete Node,
+DNS, certificate, health-check, and two-entry load-balancer configuration.
+
 ### Configure Serve scheduling capacity
 
 By default a Serve Node reports 80% of its logical CPU capacity, 75% of total
diff --git a/node.toml.example b/node.toml.example
index 3edbb8f..72eefae 100644
--- a/node.toml.example
+++ b/node.toml.example
@@ -2,6 +2,7 @@
 id = "local-node-1"
 control_api = "http://127.0.0.1:7817"
 node_token = "change-me"
+region = "default"
 work_root = "/data/node"
 
 [node.capabilities]
@@ -20,6 +21,13 @@ public_base_url = "http://127.0.0.1:8080"
 metadata_cache_ttl_seconds = 30
 artifact_cache_root = "/data/node/artifacts"
 
+# Native HTTPS uses SNI-selected certificates synchronized from the Control API.
+# Enable this on every public regional entry Node. Keep public_base_url on the
+# private HTTP listener for Peer Hop traffic and internal health checks.
+[serve.tls]
+enabled = false
+port = 8443
+
 # SSR services start on the first request for their deployment and stop
 # again after sitting idle; 0 disables the idle stop.
 [serve.ssr]