diff --git a/packages/apps/redis/values.schema.json b/packages/apps/redis/values.schema.json
index a93d92ac..6f0eccb4 100644
--- a/packages/apps/redis/values.schema.json
+++ b/packages/apps/redis/values.schema.json
@@ -91,6 +91,42 @@
       "description": "Enable password generation.",
       "type": "boolean",
       "default": true
+    },
+    "tls": {
+      "description": "TLS configuration for client-facing connections. When enabled, an nginx stream sidecar terminates TLS on port 6380. Intra-cluster traffic on 6379 (operator probes, sentinel, replication) remains plaintext.",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "description": "Enable TLS termination via nginx stream sidecar.",
+          "type": "boolean",
+          "default": false
+        },
+        "secretName": {
+          "description": "Name of an existing kubernetes.io/tls secret. When non-empty, cert-manager Certificate is NOT rendered and the user manages the secret.",
+          "type": "string",
+          "default": ""
+        },
+        "issuerRef": {
+          "description": "cert-manager Issuer reference. Used only when secretName is empty.",
+          "type": "object",
+          "properties": {
+            "name": {
+              "description": "Issuer/ClusterIssuer resource name.",
+              "type": "string",
+              "default": "selfsigned-cluster-issuer"
+            },
+            "kind": {
+              "description": "Either \"Issuer\" or \"ClusterIssuer\".",
+              "type": "string",
+              "default": "ClusterIssuer",
+              "enum": [
+                "Issuer",
+                "ClusterIssuer"
+              ]
+            }
+          }
+        }
+      }
     }
   }
 }
diff --git a/packages/apps/redis/values.yaml b/packages/apps/redis/values.yaml
index efe80d07..ca05812c 100644
--- a/packages/apps/redis/values.yaml
+++ b/packages/apps/redis/values.yaml
@@ -46,3 +46,16 @@ version: v8
 
 ## @param {bool} authEnabled - Enable password generation.
 authEnabled: true
+
+## @param {struct} tls - TLS configuration for client-facing connections. When enabled, an nginx stream sidecar terminates TLS on port 6380. Intra-cluster traffic on 6379 (operator probes, sentinel, replication) remains plaintext.
+## @field {bool} enabled - Enable TLS termination via nginx stream sidecar.
+## @field {string} secretName - Name of an existing kubernetes.io/tls secret. When non-empty, cert-manager Certificate is NOT rendered and the user manages the secret.
+## @field {struct} issuerRef - cert-manager Issuer reference. Used only when secretName is empty.
+## @field {string} issuerRef.name - Issuer/ClusterIssuer resource name.
+## @field {string} issuerRef.kind - Either "Issuer" or "ClusterIssuer".
+tls:
+  enabled: false
+  secretName: ""
+  issuerRef:
+    name: "selfsigned-cluster-issuer"
+    kind: "ClusterIssuer"