diff --git a/cleanuparr/CHANGELOG.md b/cleanuparr/CHANGELOG.md
index d6c0b03711..270f461a25 100644
--- a/cleanuparr/CHANGELOG.md
+++ b/cleanuparr/CHANGELOG.md
@@ -1,4 +1,12 @@
  
+## 2.10.6.1 (2026-09-23)
+- Fix ingress: the add-on declared `ingress: true` without `ingress_port`, so Home
+  Assistant proxied the sidebar entry and "Open Web UI" to the default port 8099,
+  where nothing listened. An nginx proxy now serves that port and rewrites the base
+  path Cleanuparr's web UI builds its asset, API and SignalR URLs from, so they
+  resolve under the ingress path instead of the Home Assistant root. Direct access
+  on port 11011 is unchanged (#3084)
+ 
 ## 2.10.6 (2026-09-19)
 - Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
 - Migrate legacy add-on configuration map names to current app configuration terminology.
diff --git a/cleanuparr/Dockerfile b/cleanuparr/Dockerfile
index 177e39a9bb..1c016a53e7 100644
--- a/cleanuparr/Dockerfile
+++ b/cleanuparr/Dockerfile
@@ -36,6 +36,12 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
 # 3 Install apps #
 ##################
 
+# Install nginx, which proxies Home Assistant ingress (see rootfs/etc/nginx/nginx.conf).
+# Installed before the rootfs is copied so dpkg does not own our nginx.conf.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends nginx && \
+    rm -rf /var/lib/apt/lists/*
+
 # Add rootfs
 COPY rootfs/ /
 RUN find /. -type f \( -name "*.sh" \) -print -exec chmod +x {} \;
diff --git a/cleanuparr/config.yaml b/cleanuparr/config.yaml
index da98a6d545..43bcfedbfa 100644
--- a/cleanuparr/config.yaml
+++ b/cleanuparr/config.yaml
@@ -91,5 +91,5 @@ schema:
   TZ: str?
 slug: cleanuparr
 url: https://github.com/alexbelgium/hassio-addons/tree/master/cleanuparr
-version: "2.10.6"
+version: "2.10.6.1"
 webui: "[PROTO:ssl]://[HOST]:[PORT:11011]"
diff --git a/cleanuparr/rootfs/etc/nginx/nginx.conf b/cleanuparr/rootfs/etc/nginx/nginx.conf
new file mode 100644
index 0000000000..19275ccec1
--- /dev/null
+++ b/cleanuparr/rootfs/etc/nginx/nginx.conf
@@ -0,0 +1,57 @@
+# Ingress proxy for Cleanuparr.
+#
+# Home Assistant serves the add-on under /api/hassio_ingress/<token>/ but strips
+# that prefix before the request reaches this container, passing it along in the
+# X-Ingress-Path header instead. Cleanuparr's own BASE_PATH option cannot be
+# used: it makes the application reject every request that does not carry the
+# prefix. So the prefix is put back into the page on its way out instead, and
+# the application keeps serving from the root on port 11011 for direct access.
+
+user root;
+pid /var/run/nginx.pid;
+worker_processes 1;
+error_log /dev/stderr error;
+
+events {
+    worker_connections 512;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log off;
+    client_max_body_size 0;
+    server_tokens off;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    # Requests that arrive without the header are not coming through ingress.
+    map $http_x_ingress_path $ingress_base_path {
+        default $http_x_ingress_path;
+        ''      /;
+    }
+
+    server {
+        listen 8099 default_server;
+
+        location / {
+            proxy_pass http://127.0.0.1:11011;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+
+            # Cleanuparr's index.html carries the base path its frontend builds
+            # every asset, API and SignalR URL from. Rewrite it to the ingress
+            # prefix so those URLs come back through ingress.
+            proxy_set_header Accept-Encoding "";
+            sub_filter_once off;
+            sub_filter "window['_server_base_path'] = '/';" "window['_server_base_path'] = '$ingress_base_path';";
+        }
+    }
+}
diff --git a/cleanuparr/rootfs/ha_entrypoint.sh b/cleanuparr/rootfs/ha_entrypoint.sh
index 34b3ab62ec..ee3cfb6845 100755
--- a/cleanuparr/rootfs/ha_entrypoint.sh
+++ b/cleanuparr/rootfs/ha_entrypoint.sh
@@ -40,6 +40,11 @@ ln -sfn "$HA_DATA_DIR" /app/config
 
 chown -R "${PUID:-0}:${PGID:-0}" "$HA_DATA_DIR"
 
+# ─── Ingress proxy ───────────────────────────────────────────────────────────
+# See /etc/nginx/nginx.conf for why ingress needs a proxy at all.
+echo "[Cleanuparr] Starting ingress proxy on port 8099..."
+nginx
+
 # ─── Start Cleanuparr directly (bypass original /entrypoint.sh) ──────────────
 echo "[Cleanuparr] Starting application on port ${HTTP_PORTS:-11011}..."
 cd /app