diff --git a/k8s/kevisual.cn/ingress/apps-ingressroute.yaml b/k8s/kevisual.cn/ingress/apps-ingressroute.yaml
index e515309..5c60aeb 100644
--- a/k8s/kevisual.cn/ingress/apps-ingressroute.yaml
+++ b/k8s/kevisual.cn/ingress/apps-ingressroute.yaml
@@ -1,5 +1,34 @@
 # Kevisual - kevisual.cn (支持 WebSocket)
 ---
+# WebSocket 支持中间件 - 完整头部配置
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: websocket-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      X-Real-IP: ""
+      X-Forwarded-For: ""
+      X-Forwarded-Host: ""
+---
+# ServersTransport 配置 - 支持长连接
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: websocket-transport
+  namespace: default
+spec:
+  serverName: ""
+  insecureSkipVerify: true
+  maxIdleConnsPerHost: 100
+  forwardingTimeouts:
+    dialTimeout: 30s
+    responseHeaderTimeout: 30s
+    idleConnTimeout: 90s
+---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -14,6 +43,9 @@ spec:
       services:
         - name: kevisual-external
           port: 3005
+          serversTransport: websocket-transport
+      middlewares:
+        - name: websocket-headers
   tls:
     certResolver: letsencrypt
 ---
@@ -31,6 +63,9 @@ spec:
       services:
         - name: kevisual-external
           port: 3005
+          serversTransport: websocket-transport
+      middlewares:
+        - name: websocket-headers
   tls:
     certResolver: letsencrypt
 ---
\ No newline at end of file