diff --git a/nginx/intrusive b/nginx/intrusive
index a776548..cbe63e7 100644
--- a/nginx/intrusive
+++ b/nginx/intrusive
@@ -34,6 +34,13 @@ server {
 server {
     server_name rpk.intrusive.games;
     root /var/www/intrusive-atproto/rpk;
+
+    # atproto requires SSL
+    listen 443 ssl;
+    ssl_certificate /etc/letsencrypt/live/intrusive.games/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/intrusive.games/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 }
 
 server {