diff --git a/smoothschedule/compose/production/traefik/traefik.yml b/smoothschedule/compose/production/traefik/traefik.yml
index 71f96c4..dbfb663 100644
--- a/smoothschedule/compose/production/traefik/traefik.yml
+++ b/smoothschedule/compose/production/traefik/traefik.yml
@@ -53,6 +53,29 @@ tls:
           sans:
             - "*.smoothschedule.com"
 
+tcp:
+  routers:
+    # Catch-all for tenant subdomains at TLS layer
+    # This matches any subdomain that isn't handled by specific HTTP routers
+    subdomain-sni-router:
+      rule: 'HostSNIRegexp(`^[a-z0-9-]+\\.smoothschedule\\.com$`)'
+      entryPoints:
+        - web-secure
+      service: nginx-tcp
+      tls:
+        passthrough: false
+        certResolver: letsencrypt-dns
+        domains:
+          - main: "smoothschedule.com"
+            sans:
+              - "*.smoothschedule.com"
+
+  services:
+    nginx-tcp:
+      loadBalancer:
+        servers:
+          - address: "nginx:80"
+
 http:
   routers:
     # Main domain and www