diff --git a/workloads/ecommerce/commerce/ingress-commerce.yaml b/workloads/ecommerce/commerce/ingress-commerce.yaml
index ad28a57..15b5918 100644
--- a/workloads/ecommerce/commerce/ingress-commerce.yaml
+++ b/workloads/ecommerce/commerce/ingress-commerce.yaml
@@ -4,6 +4,7 @@ metadata:
   name: commerce-ingress
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: ecommerce-commerce-redirect-app@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
diff --git a/workloads/ecommerce/commerce/kustomization.yaml b/workloads/ecommerce/commerce/kustomization.yaml
index 3ff2459..145d729 100644
--- a/workloads/ecommerce/commerce/kustomization.yaml
+++ b/workloads/ecommerce/commerce/kustomization.yaml
@@ -9,3 +9,4 @@ resources:
   - minio-bootstrap-job.yaml
   - medusa/
   - ingress-commerce.yaml
+  - middleware-commerce-redirect.yaml
diff --git a/workloads/ecommerce/commerce/middleware-commerce-redirect.yaml b/workloads/ecommerce/commerce/middleware-commerce-redirect.yaml
new file mode 100644
index 0000000..755a7ff
--- /dev/null
+++ b/workloads/ecommerce/commerce/middleware-commerce-redirect.yaml
@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: commerce-redirect-app
+spec:
+  # Redirige solo la raíz exacta de commerce.cruzcloud.net a /app (admin de
+  # Medusa) — el regex incluye el host a propósito: esta Middleware se
+  # referencia desde el mismo Ingress que también enruta media.cruzcloud.net,
+  # y sin el host en el regex un request a la raíz de ese otro dominio
+  # también matchearía (ambas rutas comparten Ingress -> mismas
+  # router.middlewares). Si el regex no matchea, Traefik deja pasar el
+  # request sin modificarlo.
+  redirectRegex:
+    regex: "^https?://commerce\\.cruzcloud\\.net/$"
+    replacement: "https://commerce.cruzcloud.net/app"
+    permanent: true