diff --git a/monitoring/mtls-bridge/README.md b/monitoring/mtls-bridge/README.md
index 59f62cc..25bd2d2 100644
--- a/monitoring/mtls-bridge/README.md
+++ b/monitoring/mtls-bridge/README.md
@@ -16,6 +16,7 @@ Internal HTTP-to-mTLS bridge for services that cannot present client certificate
 - `CA_CERT` (default `/certs/ca.crt`): CA certificate bundle used to verify upstream TLS.
 - `TIMEOUT` (default `5`): request timeout in seconds.
 - `LOG_LEVEL` (default `INFO`): Python logging level.
+- `MTLS_BRIDGE_BASIC_AUTH_USERS` (required for Traefik auth): value for `traefik.http.middlewares.*.basicauth.users` (e.g. `user:$$apr1$$...`).
 
 ## Endpoints
 
diff --git a/monitoring/mtls-bridge/docker-compose.yml b/monitoring/mtls-bridge/docker-compose.yml
index c58d309..b5f7e16 100644
--- a/monitoring/mtls-bridge/docker-compose.yml
+++ b/monitoring/mtls-bridge/docker-compose.yml
@@ -19,6 +19,8 @@ services:
        - "traefik.enable=true"
        - "traefik.http.routers.mtls-bridge.entrypoints=websecure"
        - "traefik.http.routers.mtls-bridge.tls.certresolver=myresolver"
+       - "traefik.http.routers.mtls-bridge.middlewares=mtls-bridge-auth"
+       - "traefik.http.middlewares.mtls-bridge-auth.basicauth.users=${MTLS_BRIDGE_BASIC_AUTH_USERS}"
        - "io.portainer.accesscontrol.public"
 #       - "traefik.http.routers.searxng.middlewares=crowdsec@file,secHeaders@file,error-pages-middleware"
        - "traefik.http.services.mtls-bridge.loadbalancer.server.port=8080"