diff --git a/cluster/k3d.yaml b/cluster/k3d.yaml
index 75f2e77..aa97868 100644
--- a/cluster/k3d.yaml
+++ b/cluster/k3d.yaml
@@ -15,6 +15,8 @@ ports:
     nodeFilters: [server:0]
   - port: 443:443  # HTTPS ingress - accessible via localhost:443
     nodeFilters: [server:0]
+  - port: 25566:25565 # Velocity/Minecraft (Traefik TCP entrypoint) - accessible via localhost:25566
+    nodeFilters: [server:0]
 
 # Integrated registry for local image development
 registries:
diff --git a/manifests/velocity-external-access.yaml b/manifests/velocity-external-access.yaml
new file mode 100644
index 0000000..c07d8ad
--- /dev/null
+++ b/manifests/velocity-external-access.yaml
@@ -0,0 +1,53 @@
+---
+# Adds a dedicated TCP entrypoint (25565) to Traefik so we can route Minecraft/Velocity traffic.
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    ports:
+      minecraft:
+        port: 25565
+        exposedPort: 25565
+        protocol: TCP
+        expose:
+          default: true
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: velocity
+  namespace: games
+  labels:
+    app: velocity
+spec:
+  type: ClusterIP
+  sessionAffinity: ClientIP
+  ports:
+    - name: velocity
+      port: 25565
+      targetPort: 25565
+      protocol: TCP
+  selector:
+    grounds/server-type: velocity
+    agones.dev/role: gameserver
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: velocity
+  namespace: games
+  labels:
+    app: velocity
+spec:
+  entryPoints:
+    - minecraft
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: velocity
+          port: 25565