diff --git a/gateway-api/dsh-demo/README.md b/gateway-api/dsh-demo/README.md
new file mode 100644
index 0000000..c3dfdf6
--- /dev/null
+++ b/gateway-api/dsh-demo/README.md
@@ -0,0 +1,49 @@
+# Gateway API — external access for `dsh-demo/dsh-gateway`
+
+Exposes the `dsh-gateway` service (`dsh-demo`, port `8080`) outside the cluster
+using the Kubernetes Gateway API (Traefik Gateway controller).
+
+## Resources
+
+| File | Kind | Purpose |
+|---|---|---|
+| `gateway.yaml` | `Gateway` | HTTPS listener with TLS termination |
+| `httproute.yaml` | `HTTPRoute` | Routes the hostname → `dsh-gateway:8080` |
+| `tls-secret.yaml.example` | `Secret` | Example TLS cert secret (not applied as-is) |
+
+## Prerequisites
+
+1. **Hostname** — replace the placeholder in `httproute.yaml` with the real FQDN.
+2. **TLS secret** — create `dsh-demo-tls` in `dsh-demo` (see `tls-secret.yaml.example`).
+3. **Ingress and DNS** — configure the upstream ingress and public DNS for the hostname.
+
+## Apply
+
+```bash
+kubectl diff -f gateway-api/dsh-demo/
+kubectl apply -f gateway-api/dsh-demo/ --dry-run=server
+kubectl apply -f gateway-api/dsh-demo/
+```
+
+> ⚠️ A write-enabled kubeconfig is required to create Gateways and HTTPRoutes.
+
+## Verify
+
+```bash
+kubectl get gateway dsh-gateway -n dsh-demo -o yaml   # expect Programmed=True
+kubectl get httproute -n dsh-demo -o wide             # expect Accepted
+kubectl get endpoints dsh-gateway -n dsh-demo         # backend present
+kubectl -n dsh-demo exec deploy/dsh-gateway -- wget -qO- http://localhost:8080/healthz
+```
+
+## Rollback
+
+```bash
+kubectl delete -f gateway-api/dsh-demo/
+```
+
+## Notes
+
+- No `ReferenceGrant` is required: the Gateway, HTTPRoute, and backend Service are
+  all in `dsh-demo`.
+- The backend (`dsh-gateway`) serves plain HTTP on 8080 and has a `/healthz` probe.
diff --git a/gateway-api/dsh-demo/gateway.yaml b/gateway-api/dsh-demo/gateway.yaml
new file mode 100644
index 0000000..ac684ed
--- /dev/null
+++ b/gateway-api/dsh-demo/gateway.yaml
@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+  labels:
+    app.kubernetes.io/part-of: dsh-demo
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: https
+      port: 8443
+      protocol: HTTPS
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: dsh-demo-tls
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/gateway-api/dsh-demo/httproute.yaml b/gateway-api/dsh-demo/httproute.yaml
new file mode 100644
index 0000000..3c80e58
--- /dev/null
+++ b/gateway-api/dsh-demo/httproute.yaml
@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: dsh-gateway
+  namespace: dsh-demo
+  labels:
+    app.kubernetes.io/part-of: dsh-demo
+spec:
+  parentRefs:
+    - name: dsh-gateway
+      namespace: dsh-demo
+      sectionName: https
+  hostnames:
+    # TODO: replace with the actual public FQDN once provided.
+    - dsh-demo.example.com
+  rules:
+    - backendRefs:
+        - name: dsh-gateway
+          port: 8080
diff --git a/gateway-api/dsh-demo/tls-secret.yaml.example b/gateway-api/dsh-demo/tls-secret.yaml.example
new file mode 100644
index 0000000..0114c5d
--- /dev/null
+++ b/gateway-api/dsh-demo/tls-secret.yaml.example
@@ -0,0 +1,17 @@
+# EXAMPLE ONLY — do not apply as-is.
+#
+# Copy to tls-secret.yaml and populate with real base64-encoded PEM material,
+# then apply. The secret must live in the dsh-demo namespace and be named
+# "dsh-demo-tls" (referenced by gateway.yaml).
+#
+#   kubectl -n dsh-demo create secret tls dsh-demo-tls \
+#     --cert=tls.crt --key=tls.key --dry-run=client -o yaml > tls-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dsh-demo-tls
+  namespace: dsh-demo
+type: kubernetes.io/tls
+data:
+  tls.crt: <base64-encoded-certificate>
+  tls.key: <base64-encoded-private-key>