diff --git a/deploy/manifests/balancer/base/gateway-listeners.yaml b/deploy/manifests/balancer/base/gateway-listeners.yaml
new file mode 100644
index 00000000..1572a1dd
--- /dev/null
+++ b/deploy/manifests/balancer/base/gateway-listeners.yaml
@@ -0,0 +1,26 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ListenerSet
+metadata:
+  name: balancer-listeners
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  parentRef:
+    name: main-gateway
+    namespace: envoy-gateway-system
+    group: gateway.networking.k8s.io
+    kind: Gateway
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: HOSTNAME_PLACEHOLDER
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: HOSTNAME_PLACEHOLDER
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: balancer-tls
+            kind: Secret
diff --git a/deploy/manifests/balancer/base/httproute.yaml b/deploy/manifests/balancer/base/httproute.yaml
new file mode 100644
index 00000000..c8fef0fe
--- /dev/null
+++ b/deploy/manifests/balancer/base/httproute.yaml
@@ -0,0 +1,39 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: balancer-redirect
+spec:
+  parentRefs:
+    - name: balancer-listeners
+      kind: ListenerSet
+      group: gateway.networking.k8s.io
+      sectionName: http
+  hostnames:
+    - HOSTNAME_PLACEHOLDER
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: balancer
+spec:
+  parentRefs:
+    - name: balancer-listeners
+      kind: ListenerSet
+      group: gateway.networking.k8s.io
+      sectionName: https
+  hostnames:
+    - HOSTNAME_PLACEHOLDER
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: balancer
+          port: 80
diff --git a/deploy/manifests/balancer/base/ingress.yaml b/deploy/manifests/balancer/base/ingress.yaml
deleted file mode 100644
index fc98305b..00000000
--- a/deploy/manifests/balancer/base/ingress.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: balancer
-  annotations: {}
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - HOSTNAME_PLACEHOLDER
-      secretName: balancer-tls
-  rules:
-    - host: HOSTNAME_PLACEHOLDER
-      http:
-        paths:
-          # All traffic routes to balancer service (which serves both API and frontend)
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: balancer
-                port:
-                  number: 8000
diff --git a/deploy/manifests/balancer/base/kustomization.yaml b/deploy/manifests/balancer/base/kustomization.yaml
index c7d2dcd1..13658e20 100644
--- a/deploy/manifests/balancer/base/kustomization.yaml
+++ b/deploy/manifests/balancer/base/kustomization.yaml
@@ -5,4 +5,5 @@ resources:
   - namespace.yaml
   - deployment.yaml
   - service.yaml
-  - ingress.yaml
+  - gateway-listeners.yaml
+  - httproute.yaml
diff --git a/deploy/manifests/balancer/base/service.yaml b/deploy/manifests/balancer/base/service.yaml
index 8f294d53..2c839248 100644
--- a/deploy/manifests/balancer/base/service.yaml
+++ b/deploy/manifests/balancer/base/service.yaml
@@ -7,7 +7,7 @@ metadata:
 spec:
   ports:
     - name: http
-      port: 8000
+      port: 80
       targetPort: 8000
   selector:
     app: balancer
diff --git a/deploy/manifests/balancer/overlays/dev/kustomization.yaml b/deploy/manifests/balancer/overlays/dev/kustomization.yaml
deleted file mode 100644
index d3975eb2..00000000
--- a/deploy/manifests/balancer/overlays/dev/kustomization.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: balancer
-
-resources:
-  - ../../base
-
-images:
-  - name: ghcr.io/codeforphilly/balancer-main/app
-    newTag: latest
-
-patches:
-  - target:
-      kind: Ingress
-      name: balancer
-    patch: |-
-      - op: add
-        path: /metadata/annotations/cert-manager.io~1cluster-issuer
-        value: letsencrypt-staging
-      - op: replace
-        path: /spec/tls/0/hosts/0
-        value: localhost
-      - op: replace
-        path: /spec/rules/0/host
-        value: localhost
diff --git a/deploy/manifests/balancer/overlays/production/kustomization.yaml b/deploy/manifests/balancer/overlays/production/kustomization.yaml
new file mode 100644
index 00000000..1386e907
--- /dev/null
+++ b/deploy/manifests/balancer/overlays/production/kustomization.yaml
@@ -0,0 +1,37 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: balancer
+
+resources:
+  - ../../base
+
+images:
+  - name: ghcr.io/codeforphilly/balancer-main/app
+    newTag: latest
+
+patches:
+  - target:
+      kind: ListenerSet
+      name: balancer-listeners
+    patch: |-
+      - op: replace
+        path: /spec/listeners/0/hostname
+        value: balancerproject.org
+      - op: replace
+        path: /spec/listeners/1/hostname
+        value: balancerproject.org
+  - target:
+      kind: HTTPRoute
+      name: balancer
+    patch: |-
+      - op: add
+        path: /spec/hostnames
+        value: ["balancerproject.org"]
+  - target:
+      kind: HTTPRoute
+      name: balancer-redirect
+    patch: |-
+      - op: add
+        path: /spec/hostnames
+        value: ["balancerproject.org"]
diff --git a/deploy/manifests/balancer/overlays/sandbox/kustomization.yaml b/deploy/manifests/balancer/overlays/sandbox/kustomization.yaml
new file mode 100644
index 00000000..c9e9b4ea
--- /dev/null
+++ b/deploy/manifests/balancer/overlays/sandbox/kustomization.yaml
@@ -0,0 +1,37 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: balancer
+
+resources:
+  - ../../base
+
+images:
+  - name: ghcr.io/codeforphilly/balancer-main/app
+    newTag: latest
+
+patches:
+  - target:
+      kind: ListenerSet
+      name: balancer-listeners
+    patch: |-
+      - op: replace
+        path: /spec/listeners/0/hostname
+        value: sandbox.balancerproject.org
+      - op: replace
+        path: /spec/listeners/1/hostname
+        value: sandbox.balancerproject.org
+  - target:
+      kind: HTTPRoute
+      name: balancer
+    patch: |-
+      - op: add
+        path: /spec/hostnames
+        value: ["sandbox.balancerproject.org"]
+  - target:
+      kind: HTTPRoute
+      name: balancer-redirect
+    patch: |-
+      - op: add
+        path: /spec/hostnames
+        value: ["sandbox.balancerproject.org"]