diff --git a/cloudflared-config.yml b/cloudflared-config.yml
index a304ad8b9..159d7c05e 100644
--- a/cloudflared-config.yml
+++ b/cloudflared-config.yml
@@ -104,6 +104,16 @@ ingress:
   - hostname: mana-api.mana.how
     service: http://localhost:3060
 
+  # ============================================
+  # mana-ai — background AI Mission Runner
+  # ============================================
+  # Serves the user-facing decrypt-audit endpoint
+  # /api/v1/me/ai-audit that powers the Workbench "Datenzugriff" tab.
+  # The background tick loop + /metrics stay internal; only the
+  # JWT-gated user endpoint is public.
+  - hostname: mana-ai.mana.how
+    service: http://localhost:3067
+
   # ============================================
   # API Gateway (Go)
   # ============================================