diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b88eb9..71f0af6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2026-06-26 — crafty-controller: Traefik https backend + scoped skip-verify (fixes 502)
+- **crafty-controller**: the healthcheck fix un-withheld the Traefik route, exposing a pre-existing
+  **502** — Traefik proxied `http://…:8443` to Crafty's **HTTPS-only** self-signed backend (Crafty serves
+  no plain-HTTP panel; `:8000` only redirects). Added two service labels:
+  - `loadbalancer.server.scheme=https` — Traefik now speaks HTTPS to the backend.
+  - `loadbalancer.serverstransport=insecure-skip-verify@file` — references the **named**
+    serversTransport defined in the controller-managed Traefik dynamic config (felhom-controller v0.83.0),
+    which skips verifying Crafty's per-container self-signed cert. Verification stays ON for every other
+    backend (scoped Option B; no global `insecureSkipVerify`). The `@file` suffix is the cross-provider
+    reference from the docker provider to the file-provider transport.
+  - Requires felhom-controller ≥ v0.83.0 (which renders the `insecure-skip-verify` transport). `port=8443`
+    and the router/tls labels are unchanged.
+
 ## 2026-06-26 — crafty-controller healthcheck fix (curl-absent + http-vs-TLS probe)
 - **crafty-controller**: container was permanently `unhealthy` → route withheld (`routeUnpublished`).
   Two independent healthcheck root causes, both fixed in one change:
diff --git a/templates/crafty-controller/docker-compose.yml b/templates/crafty-controller/docker-compose.yml
index fb92d12..a938543 100644
--- a/templates/crafty-controller/docker-compose.yml
+++ b/templates/crafty-controller/docker-compose.yml
@@ -38,6 +38,11 @@ services:
       - "traefik.http.routers.crafty-controller.tls=true"
       - "traefik.http.routers.crafty-controller.tls.certresolver=letsencrypt"
       - "traefik.http.services.crafty-controller.loadbalancer.server.port=8443"
+      # Crafty serves self-signed HTTPS on :8443 (no plain-HTTP panel) — Traefik must speak https to the
+      # backend and skip verifying the per-container self-signed cert (named transport defined in the
+      # controller-managed traefik dynamic config; verification stays ON for all other backends).
+      - "traefik.http.services.crafty-controller.loadbalancer.server.scheme=https"
+      - "traefik.http.services.crafty-controller.loadbalancer.serverstransport=insecure-skip-verify@file"
 
 volumes:
   crafty_backups: