diff --git a/manifests/aerodrome/dns/dns-stack.yaml b/manifests/aerodrome/dns/dns-stack.yaml
index 0593ec5..e558cb7 100644
--- a/manifests/aerodrome/dns/dns-stack.yaml
+++ b/manifests/aerodrome/dns/dns-stack.yaml
@@ -289,6 +289,20 @@ spec:
     protocol: TCP
 ---
 # -------------------------------------------------------------
+# Traefik Redirect Middleware (Root to /admin/)
+# -------------------------------------------------------------
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: pihole-redirect
+  namespace: dns
+spec:
+  redirectRegex:
+    regex: "^https?://([^/]+)/?$"
+    replacement: "https://${1}/admin/"
+    permanent: false
+---
+# -------------------------------------------------------------
 # Traefik ForwardAuth Middleware (Authentik Outpost)
 # -------------------------------------------------------------
 apiVersion: traefik.io/v1alpha1
@@ -308,7 +322,7 @@ spec:
     trustForwardHeader: true
 ---
 # -------------------------------------------------------------
-# Pi-hole Web Ingress (TLS + Authentik ForwardAuth)
+# Pi-hole Web Ingress (TLS + Authentik ForwardAuth + Root Redirect)
 # -------------------------------------------------------------
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -318,7 +332,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd,dns-pihole-redirect@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/manifests/spaceport/dns/dns-stack.yaml b/manifests/spaceport/dns/dns-stack.yaml
index cbd942a..d221571 100644
--- a/manifests/spaceport/dns/dns-stack.yaml
+++ b/manifests/spaceport/dns/dns-stack.yaml
@@ -289,6 +289,20 @@ spec:
     protocol: TCP
 ---
 # -------------------------------------------------------------
+# Traefik Redirect Middleware (Root to /admin/)
+# -------------------------------------------------------------
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: pihole-redirect
+  namespace: dns
+spec:
+  redirectRegex:
+    regex: "^https?://([^/]+)/?$"
+    replacement: "https://${1}/admin/"
+    permanent: false
+---
+# -------------------------------------------------------------
 # Traefik ForwardAuth Middleware (Authentik Outpost)
 # -------------------------------------------------------------
 apiVersion: traefik.io/v1alpha1
@@ -308,7 +322,7 @@ spec:
     trustForwardHeader: true
 ---
 # -------------------------------------------------------------
-# Pi-hole Web Ingress (TLS + Authentik ForwardAuth)
+# Pi-hole Web Ingress (TLS + Authentik ForwardAuth + Root Redirect)
 # -------------------------------------------------------------
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -318,7 +332,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd,dns-pihole-redirect@kubernetescrd
 spec:
   ingressClassName: traefik
   rules: