diff --git a/rotmower/application.yaml b/rotmower/application.yaml
index cb95782..4333291 100644
--- a/rotmower/application.yaml
+++ b/rotmower/application.yaml
@@ -1,4 +1,20 @@
 ---
+apiVersion: codemowers.cloud/v1beta1
+kind: OIDCMiddlewareClient
+metadata:
+  name: rotmower
+spec:
+  displayName: rotmower
+  uri: 'https://rotmower.k-space.ee'
+  headerMapping:
+    email: Remote-Email
+    groups: Remote-Groups
+    name: Remote-Name
+    user: Remote-Username
+  allowedGroups:
+    - k-space:kubernetes:admins
+    - github.com:codemowers:admins
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -7,6 +23,7 @@ metadata:
     kubernetes.io/ingress.class: traefik
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+    traefik.ingress.kubernetes.io/router.middlewares: rotmower-rotmower@kubernetescrd
 spec:
   rules:
     - host: rotmower.k-space.ee