diff --git a/docs/manuals/spaces/howtos/self-hosted/ingress-nginx-migration.md b/docs/manuals/spaces/howtos/self-hosted/ingress-nginx-migration.md
new file mode 100644
index 000000000..34ecfaa4f
--- /dev/null
+++ b/docs/manuals/spaces/howtos/self-hosted/ingress-nginx-migration.md
@@ -0,0 +1,667 @@
+---
+title: Migrate away from ingress-nginx
+sidebar_position: 7
+description: A guide on how to migrate from ingress-nginx
+tier: "business"
+---
+
+import GlobalLanguageSelector, { CodeBlock } from '@site/src/components/GlobalLanguageSelector';
+
+<GlobalLanguageSelector />
+
+`ingress-nginx` is deprecated and will reach end-of-life in March 2026. This
+guide covers migration options for existing Spaces deployments.
+
+For help choosing an exposure method, see [Exposing Spaces Externally][expose].
+<!--version
+Options vary by Spaces version. Select your Spaces version:
+
+* [Upgrading to Spaces 1.16+](#upgrading-to-spaces-116) 
+* [Cannot upgrade before March 2026](#cant-upgrade-to-spaces-116-before-march-2026) 
+version-->
+
+<!-- vale Google.Headings = NO -->
+## Prerequisites
+<!-- vale Google.Headings = YES -->
+
+Set environment variables used throughout this guide:
+
+```bash
+export SPACES_VERSION=<version>  # Example: 1.16.0
+export SPACES_ROUTER_HOST=<hostname>  # Example: proxy.example.com
+```
+
+Export your current Helm values to a file (or use an existing version-controlled
+file):
+
+```bash
+helm get values spaces -n upbound-system -o yaml > values.yaml
+```
+
+You'll merge new configuration into this file throughout the migration.
+
+<!--version
+## Upgrading to Spaces 1.16+
+
+Choose your migration option:
+
+| Option | When to use |
+|--------|-------------|
+| [LoadBalancer Service](#loadbalancer-service-recommended) | Simplest setup, no additional components needed |
+| [Gateway API](#gateway-api) | Already using Gateway API or need shared gateway |
+| [Alternative ingress controller](#alternative-ingress-controller) | Already using Ingress, or need shared load balancer |
+
+All paths follow the same process: upgrade to 1.16+, switch exposure method,
+then uninstall ingress-nginx.
+
+
+
+### Upgrade to 1.16+ with Updated Ingress Values
+
+Spaces doesn't provision the Ingress resource by default and is now
+controller-agnostic.
+
+Add the following to your `values.yaml` to keep ingress-nginx working:
+
+```yaml
+ingress:
+  provision: true
+  host: proxy.example.com  # Replace with your existing hostname
+  ingressClassName: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+  podLabels:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/component: controller
+  namespaceLabels:
+    kubernetes.io/metadata.name: ingress-nginx
+```
+
+Upgrade Spaces to 1.16+:
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version ${SPACES_VERSION} \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+Verify ingress-nginx is still working before you continue.
+
+### LoadBalancer Service (Recommended)
+
+This section describes how to expose the `spaces-router` with a LoadBalancer
+Service.
+
+:::important
+Use a Network Load Balancer (L4), not an Application Load Balancer (L7). Spaces
+uses long-lived connections for watch traffic that L7 load balancers may
+timeout. 
+:::
+
+**1. Add the LoadBalancer Service configuration to your `values.yaml`**
+
+```yaml
+externalTLS:
+  host: proxy.example.com  # Must match your ingress.host
+
+router:
+  proxy:
+    service:
+      type: LoadBalancer
+      annotations:
+        # AWS NLB (see Cloud-Specific Annotations for other clouds)
+        service.beta.kubernetes.io/aws-load-balancer-type: external
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+        service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+```
+
+:::note
+This example uses AWS-specific annotations. See [Cloud-Specific Annotations for GCP and Azure][expose-annotate].
+:::
+
+**2. Upgrade Spaces (Ingress stays running during transition)**
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version ${SPACES_VERSION} \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+**3. Get the new LoadBalancer address**
+
+```bash
+kubectl get svc -n upbound-system spaces-router \
+  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
+```
+
+**4. Validate before switching DNS**
+
+```bash
+# Get spaces-router load balancer address
+ROUTER_LB=$(kubectl get svc -n upbound-system spaces-router -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
+
+# Test connectivity using --connect-to to route to the new LB
+curl --connect-to "${SPACES_ROUTER_HOST}:443:${ROUTER_LB}:443" "https://${SPACES_ROUTER_HOST}/version"
+# Expected: 401 Unauthorized (routing works, auth required)
+```
+
+**5. Update your DNS record to point to the new LoadBalancer address**
+
+**6. Update your `values.yaml` to disable Ingress, then upgrade Spaces**
+
+```yaml
+ingress:
+  provision: false
+```
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version ${SPACES_VERSION} \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+**7. Uninstall ingress-nginx**
+
+```bash
+helm uninstall ingress-nginx --namespace ingress-nginx
+```
+
+### Gateway API
+
+Spaces supports the [Gateway API][gateway-api] as an alternative to Ingress. Gateway API is the
+Kubernetes standard for traffic routing going forward.
+
+
+**1. Install Envoy Gateway**
+
+```bash
+helm install eg oci://docker.io/envoyproxy/gateway-helm \
+  --namespace envoy-gateway-system \
+  --create-namespace \
+  --wait
+```
+
+See [Envoy Gateway installation docs][envoy-install] for more detailed instructions.
+
+**2. Create a GatewayClass**
+
+Create a `GatewayClass` resource.
+
+
+```bash
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: spaces
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: spaces-proxy-config
+    namespace: envoy-gateway-system
+EOF
+```
+
+**3. Configure Spaces Helm Values**
+
+```yaml
+ingress:
+  provision: false  # Disable Ingress when using Gateway API
+
+gatewayAPI:
+  host: proxy.example.com
+  gateway:
+    provision: true
+    name: spaces
+    className: spaces
+  spacesRouterRoute:
+    provision: true
+  podLabels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+  namespaceLabels:
+    kubernetes.io/metadata.name: envoy-gateway-system
+```
+
+**4. Install or Upgrade Spaces**
+
+See [Spaces installation docs][spaces-install] for detailed installation instructions.
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+**5. Get the Gateway Address**
+
+```bash
+kubectl get gateway -n upbound-system spaces \
+  -o jsonpath='{.status.addresses[0].value}'
+```
+
+Create or update a DNS record pointing your `gatewayAPI.host` to this address.
+
+
+:::note
+If you're having issues with your setup, verify the configuration with these
+troubleshooting steps:
+
+* **Check Gateway Status**
+
+    ```bash
+    kubectl get gateway -n upbound-system spaces -o yaml
+    ```
+    
+    Look for `status.conditions` - the Gateway should be `Accepted` and `Programmed`.
+
+* **Check TLSRoute Status**
+
+    ```bash
+    kubectl get tlsroute -n upbound-system spaces-router -o yaml
+    ```
+    
+    The route should show `Accepted: True` in its status.
+
+* **Verify Connectivity**
+
+    ```bash
+    curl -k "https://${SPACES_ROUTER_HOST}/version"
+    # Expected: 401 Unauthorized (routing works, auth required)
+    ```
+:::
+
+**6. Validate before switching DNS**
+
+```bash
+# Get Gateway address
+GATEWAY_LB=$(kubectl get gateway -n upbound-system spaces -o jsonpath='{.status.addresses[0].value}')
+
+# Test connectivity using --connect-to to route to the new Gateway
+curl --connect-to "${SPACES_ROUTER_HOST}:443:${GATEWAY_LB}:443" "https://${SPACES_ROUTER_HOST}/version"
+# Expected: 401 Unauthorized (routing works, auth required)
+```
+
+**7. Update your DNS record to point to the new Gateway address**
+
+**8. Update your `values.yaml` to disable Ingress, then upgrade Spaces:**
+
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version ${SPACES_VERSION} \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+**9. Uninstall ingress-nginx**
+
+```bash
+helm uninstall ingress-nginx --namespace ingress-nginx
+```
+
+### Alternative ingress controller
+
+Use any Ingress controller that supports TLS passthrough.
+
+Configure your Ingress controller's Service with `NLB`
+annotations. See [Cloud-specific annotations][expose-annotate].
+
+**1. Install your chosen Ingress controller**
+
+**2. Update the ingress configuration in your `values.yaml`**
+
+```yaml
+ingress:
+  provision: true
+  host: proxy.example.com
+  ingressClassName: <your-ingress-class>
+  annotations:
+    # Add your controller's TLS passthrough annotations
+  podLabels:
+    # Labels matching your controller's pods
+  namespaceLabels:
+    # Labels matching your controller's namespace
+```
+
+**3. Upgrade Spaces**
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version ${SPACES_VERSION} \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+**4. Get the new load balancer address and update DNS**
+
+```bash
+kubectl get svc -n <controller-namespace> <controller-service> -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
+```
+
+**5. Uninstall ingress-nginx**
+
+```bash
+helm uninstall ingress-nginx --namespace ingress-nginx
+```
+
+
+version-->
+<!-- vale Google.Headings = NO -->
+## Migrate current Spaces version before March 2026
+<!-- vale Google.Headings = YES -->
+
+Choose your migration option:
+
+| Option | When to use |
+|--------|-------------|
+| [Gateway API](#gateway-api-spaces-110) | Already using Gateway API or need shared gateway |
+| [Traefik](#traefik-or-alternative-ingress-controller) | Migrate from nginx Ingress to alternative controller |
+
+Export your current Helm values to a file (or use your existing values file if
+stored in Git):
+
+```bash
+helm get values spaces -n upbound-system -o yaml > values.yaml
+```
+
+<!-- vale Google.Headings = NO -->
+### Gateway API (Spaces 1.10+)
+<!-- vale Google.Headings = YES -->
+
+Gateway API support has been available since Spaces 1.10. See [Gateway API
+Configuration][gateway-api-config] for detailed setup instructions.
+
+:::note
+Pre-1.16 Spaces doesn't support running Ingress and Gateway API
+simultaneously. This migration requires switching over in a single upgrade,
+which causes brief downtime during DNS propagation.
+:::
+
+**1. Remove existing ingress resources**
+
+Delete the Ingress resource and ingress-nginx controller:
+
+```bash
+kubectl -n upbound-system delete ingress mxe-router-ingress
+helm -n ingress-nginx delete ingress-nginx
+```
+
+:::warning
+This step forces downtime for API access through spaces-router until the
+Gateway API configuration is complete.
+:::
+
+**2. Install a gateway API controller**
+
+Install a Gateway API implementation that supports TLS passthrough and
+`TLSRoute`. 
+
+The following example uses Envoy Gateway:
+
+```bash
+export ENVOY_GATEWAY_VERSION=<version> # Example: v1.2.4
+
+helm -n envoy-gateway-system upgrade --install --wait --wait-for-jobs \
+  --timeout 300s --create-namespace envoy-gateway \
+  oci://docker.io/envoyproxy/gateway-helm \
+  --version "${ENVOY_GATEWAY_VERSION}"
+```
+
+**3. Create GatewayClass resource**
+
+Create a `GatewayClass` resource.
+
+
+```bash
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: spaces
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: spaces-proxy-config
+    namespace: envoy-gateway-system
+EOF
+```
+**4. Create Gateway resource**
+
+Create a Gateway resource in the `upbound-system` namespace.
+
+
+```bash
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: spaces
+  namespace: upbound-system
+spec:
+  gatewayClassName: spaces
+  listeners:
+    - name: tls
+      port: 443
+      protocol: TLS
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Passthrough
+EOF
+```
+
+**5. Update your Helm values**
+
+```yaml
+ingress:
+  provision: false
+
+gatewayAPI:
+  host: proxy.example.com  # Must match your current ingress.host
+  gateway:
+    provision: true
+    name: spaces
+    className: spaces  # Must match your GatewayClass name
+  spacesRouterRoute:
+    provision: true
+  # Labels for NetworkPolicy - must match your gateway controller's pods
+  podLabels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+  namespaceLabels:
+    kubernetes.io/metadata.name: envoy-gateway-system
+```
+**6. Get the load balancer hostname**
+
+Check the externally routable hostname for the Gateway's load balancer. 
+The Helm `gatewayAPI.host` parameter requires this hostname.
+
+For Envoy Gateway, inspect the LoadBalancer service:
+
+```bash
+kubectl get service -n envoy-gateway-system \
+  -l gateway.envoyproxy.io/owning-gateway-name=spaces \
+  -o jsonpath='{.items[0].status.loadBalancer.ingress[0].hostname}'
+```
+
+**7. Upgrade the Spaces Helm release**
+
+Upgrade the Spaces installation with Gateway API parameters:
+
+```bash
+helm -n upbound-system upgrade spaces \
+  oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version "${SPACES_VERSION}" \
+  --set "ingress.provision=false" \
+  --set "gatewayAPI.host=${GATEWAY_HOSTNAME}" \
+  --set "account=${UPBOUND_ACCOUNT}" \
+  --reuse-values \
+  --wait
+```
+
+**8. Restart spaces-router (optional)**
+
+If the `gatewayAPI.host` value differs from the previous `ingress.host` value,
+restart the spaces-router pod to regenerate the certificate with the correct
+SAN:
+
+```bash
+kubectl -n upbound-system rollout restart deployment spaces-router
+kubectl -n upbound-system rollout status deployment spaces-router
+```
+
+**9. Configure values.yaml**
+
+Update your `values.yaml` to disable Ingress and enable Gateway API:
+
+```yaml
+ingress:
+  provision: false
+
+gatewayAPI:
+  host: proxy.example.com  # Must match your current ingress.host
+  gateway:
+    provision: true
+    name: spaces
+    className: spaces  # Must match your GatewayClass name
+  spacesRouterRoute:
+    provision: true
+  # Labels for NetworkPolicy - must match your gateway controller's pods
+  podLabels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+  namespaceLabels:
+    kubernetes.io/metadata.name: envoy-gateway-system
+```
+
+**10. Upgrade Spaces**
+
+This disables Ingress and enables Gateway API:
+
+```bash
+helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
+  --version ${SPACES_VERSION} \
+  --namespace upbound-system \
+  -f values.yaml \
+  --wait
+```
+
+**11. Get the gateway address and update DNS**
+
+```bash
+kubectl get gateway -n upbound-system spaces -o jsonpath='{.status.addresses[0].value}'
+```
+
+Update your DNS record to this address.
+
+**12. Verify connectivity**
+
+```bash
+curl -v "https://${SPACES_ROUTER_HOST}/version"
+# Expected: 401 Unauthorized (routing works, auth required)
+```
+
+**13. Uninstall ingress-nginx**
+
+```bash
+helm uninstall ingress-nginx --namespace ingress-nginx
+```
+
+### Traefik (or alternative ingress controller)
+
+Traefik can pick up the existing nginx Ingress via
+`--providers.kubernetesIngressNGINX`. See the [Traefik migration
+guide][traefik-migrate] for details.
+
+**1. Install Traefik with nginx Ingress provider**
+
+```bash
+helm repo add traefik https://traefik.github.io/charts
+helm repo update
+helm upgrade --install traefik traefik/traefik \
+  --create-namespace --namespace traefik \
+  --set 'service.type=LoadBalancer' \
+  --set 'additionalArguments={--providers.kubernetesIngressNGINX}' \
+  --wait
+```
+<!-- vale gitlab.Uppercase = NO -->
+Configure Traefik's Service with NLB annotations. See
+[Cloud-specific annotations][expose-annotate].
+<!-- vale gitlab.Uppercase = YES -->
+
+**2. Validate before switching DNS**
+
+```bash
+# Get Traefik load balancer address
+TRAEFIK_LB=$(kubectl get svc -n traefik traefik -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
+
+# Test connectivity using --connect-to to route to Traefik
+curl --connect-to "${SPACES_ROUTER_HOST}:443:${TRAEFIK_LB}:443" "https://${SPACES_ROUTER_HOST}/version"
+# Expected: 401 Unauthorized (routing works, auth required)
+```
+
+**3. Update DNS to point to Traefik**
+
+```bash
+kubectl get svc -n traefik traefik -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
+```
+
+Update your DNS record to this address. For gradual migration, use weighted DNS routing.
+
+**4. Preserve the nginx IngressClass before uninstalling ingress-nginx**
+
+```bash
+helm upgrade ingress-nginx ingress-nginx \
+  --repo https://kubernetes.github.io/ingress-nginx \
+  --namespace ingress-nginx \
+  --reuse-values \
+  --set-json 'controller.ingressClassResource.annotations={"helm.sh/resource-policy": "keep"}'
+```
+
+**5. Uninstall ingress-nginx**
+
+```bash
+helm uninstall ingress-nginx --namespace ingress-nginx
+```
+
+Keep `ingress.provision: true` so the Spaces chart continues to manage the
+Ingress resource. Traefik picks it up via the nginx provider.
+
+
+## Verification
+
+After migration, verify connectivity:
+
+```bash
+curl -v "https://${SPACES_ROUTER_HOST}/version"
+# Expected: 401 Unauthorized
+```
+
+[envoy-install]: https://gateway.envoyproxy.io/docs/install/
+[spaces-install]: /manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment/
+[traefik-migrate]: https://doc.traefik.io/traefik/migrate/nginx-to-traefik/
+[spaces-deploy]: /manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment/
+[k8s-announce]: https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-retirement/
+[expose]: /manuals/spaces/howtos/self-hosted/ingress/
+[expose-annotate]: /manuals/spaces/howtos/self-hosted/ingress/#cloud-specific-annotations
+[gateway-api]: https://gateway-api.sigs.k8s.io/
+[gateway-api-config]: /manuals/spaces/howtos/self-hosted/ingress/#gateway-api
diff --git a/docs/manuals/spaces/howtos/self-hosted/ingress.md b/docs/manuals/spaces/howtos/self-hosted/ingress.md
new file mode 100644
index 000000000..44b47a773
--- /dev/null
+++ b/docs/manuals/spaces/howtos/self-hosted/ingress.md
@@ -0,0 +1,137 @@
+---
+title: Exposing Spaces externally
+sidebar_position: 5
+description: Options for exposing Spaces externally
+---
+
+import { CodeBlock } from '@site/src/components/GlobalLanguageSelector';
+
+
+You can expose Spaces externally using of three options:
+
+| Option | When to use |
+|--------|-------------|
+| LoadBalancer Service | Simplest setup, recommended for most deployments |
+| Gateway API | Organization already using Gateway API, or need shared gateway across services |
+| Ingress | Organization already using Ingress, or need shared load balancer across services |
+<!-- vale Google.Headings = NO -->
+## LoadBalancer Service
+<!-- vale Google.Headings = YES -->
+
+Upbound recommends a LoadBalancer Service to expose `spaces-router`.
+
+
+:::important
+Use a Network Load Balancer (L4), not an Application Load Balancer (L7). Spaces
+uses long-lived connections for watch traffic that L7 load balancers may
+timeout.
+:::
+
+### Configuration
+<!-- vale gitlab.Uppercase = NO -->
+```yaml
+externalTLS:
+  host: proxy.example.com  # Externally routable hostname for TLS certificates
+
+router:
+  proxy:
+    service:
+      type: LoadBalancer
+      annotations:
+        # AWS NLB (see Cloud-Specific Annotations for other clouds)
+        service.beta.kubernetes.io/aws-load-balancer-type: external
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+        service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+```
+
+See [Cloud-Specific Annotations](#cloud-specific-annotations) for GCP and Azure.
+
+<!-- vale Google.Headings = NO -->
+### Get the LoadBalancer address
+<!-- vale Google.Headings = YES -->
+
+After installation:
+
+```bash
+kubectl get svc -n upbound-system spaces-router \
+  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
+```
+
+Create or update a DNS record pointing your `externalTLS.host` to this address.
+
+## Ingress
+
+Use Ingress if you need to share a load balancer across multiple services or
+have specific networking requirements.
+
+### Requirements
+
+- TLS passthrough support in your Ingress controller
+- Network Load Balancer (L4) strongly recommended for long-lived connections
+<!-- vale gitlab.Uppercase = NO -->
+Configure your Ingress controller's Service with [NLB annotations](#cloud-specific-annotations).
+<!-- vale gitlab.Uppercase = YES -->
+
+### Configuration
+
+```yaml
+ingress:
+  provision: true
+  host: proxy.example.com
+  ingressClassName: "<your-ingress-class>"
+  # Annotations to add to the Ingress resource
+  annotations: {}
+  # Pod labels of the Ingress controller - used for network policy
+  podLabels: {}
+  # Namespace labels of the Ingress controller - used for network policy
+  namespaceLabels: {}
+```
+
+### Traefik (with nginx provider)
+
+Traefik can use the [kubernetesIngressNGINX provider][traefik-provider] to
+handle nginx-style Ingress resources with TLS passthrough.
+
+```yaml
+ingress:
+  provision: true
+  host: proxy.example.com
+  ingressClassName: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+  podLabels:
+    app.kubernetes.io/name: traefik
+  namespaceLabels:
+    kubernetes.io/metadata.name: traefik
+```
+
+## Gateway API
+
+Spaces supports the [Gateway API][gateway-api-docs]. Use this option if your
+organization is already using Gateway API or needs a shared gateway across
+multiple services.
+
+### Requirements
+
+- A Gateway API controller (for example, Envoy Gateway, Cilium, or Traefik)
+- Gateway API CRDs installed in your cluster
+- TLS passthrough support
+- Network Load Balancer (L4) strongly recommended
+
+## Cloud-specific annotations
+
+Network Load Balancers (L4) are strongly recommended. Spaces uses long-lived
+watch connections (hours or days) for kubectl and ArgoCD. L7 load balancers may
+timeout these connections. Use these annotations on the LoadBalancer Service
+(spaces-router, Ingress controller, or Gateway).
+
+| Cloud | Annotations |
+|-------|-------------|
+| **AWS** | `service.beta.kubernetes.io/aws-load-balancer-type: external`<br/>`service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing`<br/>`service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip` |
+| **GCP** | `cloud.google.com/l4-rbs: enabled` |
+| **Azure** | None required (L4 by default) |
+<!-- vale gitlab.Uppercase = YES -->
+
+[traefik-provider]: https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-ingress-nginx/
+[gateway-api-docs]: https://gateway-api.sigs.k8s.io/
diff --git a/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md b/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md
index e549e3939..e24b95ab8 100644
--- a/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md
+++ b/docs/manuals/spaces/howtos/self-hosted/self-hosted-spaces-deployment.md
@@ -1,7 +1,7 @@
 ---
 title: Deployment Workflow
 sidebar_position: 3
-description: A  quickstart guide for Upbound Spaces
+description: A quickstart guide for Upbound Spaces
 tier: "business"
 ---
 import GlobalLanguageSelector, { CodeBlock } from '@site/src/components/GlobalLanguageSelector';
@@ -249,59 +249,135 @@ helm install aws-load-balancer-controller aws-load-balancer-controller --namespa
 
 </CodeBlock>
 
-### Install ingress-nginx
+### Install Envoy Gateway
 
-Starting with Spaces v1.10.0, you need to configure the ingress-nginx
-controller to allow SSL-passthrough mode. You can do so by passing the
-`--enable-ssl-passthrough=true` command-line option to the controller.
-The following Helm install command enables this with the `controller.extraArgs`
-parameter:
+Starting with Spaces v1.10.0, Upbound recommends using the [Gateway API] for
+routing traffic to Spaces. Gateway API is the official Kubernetes standard for
+ingress and replaces the legacy Ingress API.
+
+This guide uses Envoy Gateway as the Gateway API controller and replaces
+ingress-nginx previously recommended. 
+
+:::info
+If you need to continue to use ingress-nginx temporarily, use the [ingress-nginx
+migration guide][migration guide].
+
+The Kubernetes community announced that ingress-nginx will be retired in March
+2026 and you should plan to migrate to Gateway API before then.
+:::
+
+
+First, install Envoy Gateway with Helm:
+
+```bash
+helm -n envoy-gateway-system upgrade --install --wait --wait-for-jobs \
+  --timeout 360s --create-namespace envoy-gateway \
+  oci://docker.io/envoyproxy/gateway-helm \
+  --version "v1.2.4"
+```
+
+Next, create the Gateway API resources for your cloud provider:
 
 <CodeBlock cloud="aws">
 
+Create EnvoyProxy configuration for AWS load balancer
+
 ```bash
-helm upgrade --install ingress-nginx ingress-nginx \
-  --create-namespace --namespace ingress-nginx \
-  --repo https://kubernetes.github.io/ingress-nginx \
-  --version 4.12.1 \
-  --set 'controller.service.type=LoadBalancer' \
-  --set 'controller.extraArgs.enable-ssl-passthrough=true' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type=external' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-scheme=internet-facing' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-nlb-target-type=ip' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-healthcheck-protocol=http' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-healthcheck-path=/healthz' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-healthcheck-port=10254' \
-  --wait
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: spaces-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        annotations:
+          service.beta.kubernetes.io/aws-load-balancer-type: external
+          service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+          service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+          service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: http
+          service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /healthz
+          service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "19002"
+EOF
+```
+
+
+Create GatewayClass:
+
+```bash
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: spaces
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: spaces-proxy-config
+    namespace: envoy-gateway-system
+EOF
 ```
 
 </CodeBlock>
 
 <CodeBlock cloud="azure">
+```bash
+Create EnvoyProxy configuration for Azure load balancer:
 
 ```bash
-helm upgrade --install ingress-nginx ingress-nginx \
-  --create-namespace --namespace ingress-nginx \
-  --repo https://kubernetes.github.io/ingress-nginx \
-  --version 4.12.1 \
-  --set 'controller.service.type=LoadBalancer' \
-  --set 'controller.extraArgs.enable-ssl-passthrough=true' \
-  --set 'controller.service.annotations.service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path=/healthz' \
-  --wait
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: spaces-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        annotations:
+          service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: /healthz
+EOF
+```
+
+Create GatewayClass:
+
+```bash
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: spaces
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: spaces-proxy-config
+    namespace: envoy-gateway-system
+EOF
 ```
 
 </CodeBlock>
 
 <CodeBlock cloud="gcp">
 
+Create GatewayClass:
 ```bash
-helm upgrade --install ingress-nginx ingress-nginx \
-  --create-namespace --namespace ingress-nginx \
-  --repo https://kubernetes.github.io/ingress-nginx \
-  --version 4.12.1 \
-  --set 'controller.service.type=LoadBalancer' \
-  --set 'controller.extraArgs.enable-ssl-passthrough=true' \
-  --wait
+kubectl apply -f - --server-side <<EOF
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: spaces
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+EOF
 ```
 
 </CodeBlock>
@@ -375,7 +451,10 @@ kubectl get ingress \
 
 </CodeBlock>
 
-If the preceding command doesn't return a load balancer address then your provider may not have allocated it yet. Once it's available, add a DNS record for the `ROUTER_HOST` to point to the given load balancer address. If it's an IPv4 address, add an A record. If it's a domain name, add a CNAME record.
+If the preceding command doesn't return a load balancer address then your
+provider may not have allocated it yet. Once it's available, add a DNS record
+for the `ROUTER_HOST` to point to the given load balancer address. If it's an
+IPv4 address, add an A record. If it's a domain name, add a CNAME record.
 
 ## Configure the up CLI
 
@@ -435,7 +514,12 @@ kubectl wait controlplane ctp1 --for condition=Ready=True --timeout=360s
 
 ## Connect to your control plane
 
-Connect to your control plane with the `up ctx` command. With your kubeconfig still pointed at the Kubernetes cluster where you installed the Upbound Space, run the following:
+<!-- vale Upbound.Spelling = NO -->
+Connect to your control plane with the up ctx command. With your kubeconfig
+still pointed at the Kubernetes cluster where you installed the Upbound Space,
+run the following:
+<!-- vale Upbound.Spelling = YES -->
+
 
 ```bash
 up ctx ./default/ctp1
diff --git a/utils/vale/styles/Upbound/spelling-exceptions.txt b/utils/vale/styles/Upbound/spelling-exceptions.txt
index 80f6e139c..ec6468956 100644
--- a/utils/vale/styles/Upbound/spelling-exceptions.txt
+++ b/utils/vale/styles/Upbound/spelling-exceptions.txt
@@ -37,6 +37,7 @@ configmaps
 CRDs
 Crossplane
 Crossplane's
+ctx
 Datadog
 declaratively
 downscaling
@@ -144,4 +145,12 @@ XRDs
 XRs
 Zendesk
 Upjet
+GCP
+nginx
+Traefik
+Traefik's
+hostname
+HTTPRoute
+TLSRoute
+passthrough