diff --git a/services/sourcehut.nix b/services/sourcehut.nix
index 1a76d71..d265da7 100644
--- a/services/sourcehut.nix
+++ b/services/sourcehut.nix
@@ -109,6 +109,14 @@ in {
     metasrht.extraGroups = [ "sourcehut" ];
   };
 
+  services.nginx.virtualHosts."git.${domain}" = {
+    forceSSL = true;
+    useACMEHost = my.domain;
+    kTLS = true;
+    # `globalRedirect` appends `$request_uri` to the target, which we do not want here
+    locations."/".return = "https://git.${fqdn}";
+  };
+
   services.restic.backups.gitsrht = {
     environmentFile = secrets."restic/rest-env".path;
     initialize = true;