diff --git a/helm/charts/nats/files/headless-service.yaml b/helm/charts/nats/files/headless-service.yaml
index e4a4085c..ee076023 100644
--- a/helm/charts/nats/files/headless-service.yaml
+++ b/helm/charts/nats/files/headless-service.yaml
@@ -14,6 +14,13 @@ spec:
   {{- range $protocol := list "nats" "leafnodes" "websocket" "mqtt" "cluster" "gateway" "monitor" "profiling" }}
   {{- $configProtocol := get $.Values.config $protocol }}
   {{- if or (eq $protocol "nats") $configProtocol.enabled }}
-  - {{ dict "name" $protocol "port" $configProtocol.port "targetPort" $protocol | toYaml | nindent 4 }}
+  {{- $tlsEnabled := false }}
+  {{- if hasKey $configProtocol "tls" }}
+    {{- $tlsEnabled = $configProtocol.tls.enabled }}
+  {{- else if eq $protocol "monitor" }}
+    {{- $tlsEnabled = $.Values.config.nats.tls.enabled }}
+  {{- end }}
+  {{- $appProtocol := or (eq $protocol "websocket") (eq $protocol "monitor") | ternary ($tlsEnabled | ternary "https" "http") ($tlsEnabled | ternary "tls" "tcp") }}
+  - {{ dict "name" $protocol "port" $configProtocol.port "targetPort" $protocol "appProtocol" $appProtocol | toYaml | nindent 4 }}
   {{- end }}
   {{- end }}
diff --git a/helm/charts/nats/files/service.yaml b/helm/charts/nats/files/service.yaml
index 49b6bba9..17fae482 100644
--- a/helm/charts/nats/files/service.yaml
+++ b/helm/charts/nats/files/service.yaml
@@ -13,6 +13,13 @@ spec:
   {{- $configProtocol := get $.Values.config $protocol }}
   {{- $servicePort := get $.Values.service.ports $protocol }}
   {{- if and (or (eq $protocol "nats") $configProtocol.enabled) $servicePort.enabled }}
-  - {{ merge (dict "name" $protocol "targetPort" $protocol) (omit $servicePort "enabled") (dict "port" $configProtocol.port) | toYaml | nindent 4 }}
+  {{- $tlsEnabled := false }}
+  {{- if hasKey $configProtocol "tls" }}
+    {{- $tlsEnabled = $configProtocol.tls.enabled }}
+  {{- else if eq $protocol "monitor" }}
+    {{- $tlsEnabled = $.Values.config.nats.tls.enabled }}
+  {{- end }}
+  {{- $appProtocol := or (eq $protocol "websocket") (eq $protocol "monitor") | ternary ($tlsEnabled | ternary "https" "http") ($tlsEnabled | ternary "tls" "tcp") }}
+  - {{ merge (dict "name" $protocol "targetPort" $protocol "appProtocol" $appProtocol) (omit $servicePort "enabled") (dict "port" $configProtocol.port) | toYaml | nindent 4 }}
   {{- end }}
   {{- end }}
diff --git a/helm/charts/nats/test/config_test.go b/helm/charts/nats/test/config_test.go
index ea46d9ef..49fb3846 100644
--- a/helm/charts/nats/test/config_test.go
+++ b/helm/charts/nats/test/config_test.go
@@ -106,19 +106,22 @@ config:
 
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "cluster",
-			Port:       6222,
-			TargetPort: intstr.FromString("cluster"),
+			Name:        "cluster",
+			Port:        6222,
+			TargetPort:  intstr.FromString("cluster"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "monitor",
-			Port:       8222,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        8222,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}
 
@@ -249,19 +252,22 @@ config:
 
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "cluster",
-			Port:       6222,
-			TargetPort: intstr.FromString("cluster"),
+			Name:        "cluster",
+			Port:        6222,
+			TargetPort:  intstr.FromString("cluster"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "monitor",
-			Port:       8222,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        8222,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}
 
@@ -463,62 +469,73 @@ config:
 
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "leafnodes",
-			Port:       7422,
-			TargetPort: intstr.FromString("leafnodes"),
+			Name:        "leafnodes",
+			Port:        7422,
+			TargetPort:  intstr.FromString("leafnodes"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "mqtt",
-			Port:       1883,
-			TargetPort: intstr.FromString("mqtt"),
+			Name:        "mqtt",
+			Port:        1883,
+			TargetPort:  intstr.FromString("mqtt"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "cluster",
-			Port:       6222,
-			TargetPort: intstr.FromString("cluster"),
+			Name:        "cluster",
+			Port:        6222,
+			TargetPort:  intstr.FromString("cluster"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "gateway",
-			Port:       7222,
-			TargetPort: intstr.FromString("gateway"),
+			Name:        "gateway",
+			Port:        7222,
+			TargetPort:  intstr.FromString("gateway"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "monitor",
-			Port:       8222,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        8222,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}
 
 	expected.Service.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "leafnodes",
-			Port:       7422,
-			TargetPort: intstr.FromString("leafnodes"),
+			Name:        "leafnodes",
+			Port:        7422,
+			TargetPort:  intstr.FromString("leafnodes"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "mqtt",
-			Port:       1883,
-			TargetPort: intstr.FromString("mqtt"),
+			Name:        "mqtt",
+			Port:        1883,
+			TargetPort:  intstr.FromString("mqtt"),
+			AppProtocol: &appProtocolTCP,
 		},
 	}
 
@@ -679,62 +696,73 @@ config:
 
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "leafnodes",
-			Port:       7422,
-			TargetPort: intstr.FromString("leafnodes"),
+			Name:        "leafnodes",
+			Port:        7422,
+			TargetPort:  intstr.FromString("leafnodes"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTPS,
 		},
 		{
-			Name:       "mqtt",
-			Port:       1883,
-			TargetPort: intstr.FromString("mqtt"),
+			Name:        "mqtt",
+			Port:        1883,
+			TargetPort:  intstr.FromString("mqtt"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "cluster",
-			Port:       6222,
-			TargetPort: intstr.FromString("cluster"),
+			Name:        "cluster",
+			Port:        6222,
+			TargetPort:  intstr.FromString("cluster"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "gateway",
-			Port:       7222,
-			TargetPort: intstr.FromString("gateway"),
+			Name:        "gateway",
+			Port:        7222,
+			TargetPort:  intstr.FromString("gateway"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "monitor",
-			Port:       8222,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        8222,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTPS,
 		},
 	}
 
 	expected.Service.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "leafnodes",
-			Port:       7422,
-			TargetPort: intstr.FromString("leafnodes"),
+			Name:        "leafnodes",
+			Port:        7422,
+			TargetPort:  intstr.FromString("leafnodes"),
+			AppProtocol: &appProtocolTLS,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTPS,
 		},
 		{
-			Name:       "mqtt",
-			Port:       1883,
-			TargetPort: intstr.FromString("mqtt"),
+			Name:        "mqtt",
+			Port:        1883,
+			TargetPort:  intstr.FromString("mqtt"),
+			AppProtocol: &appProtocolTLS,
 		},
 	}
 
@@ -842,6 +870,7 @@ extraResources:
         - name: gateway
           port: 7222
           targetPort: gateway
+          appProtocol: tcp
 - $tplYaml: |
     apiVersion: v1
     kind: ConfigMap
@@ -863,9 +892,10 @@ extraResources:
 	expected.ExtraService.HasValue = true
 	expected.ExtraService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "gateway",
-			Port:       7222,
-			TargetPort: intstr.FromString("gateway"),
+			Name:        "gateway",
+			Port:        7222,
+			TargetPort:  intstr.FromString("gateway"),
+			AppProtocol: &appProtocolTCP,
 		},
 	}
 
diff --git a/helm/charts/nats/test/defaults_test.go b/helm/charts/nats/test/defaults_test.go
index 9a993a78..d946ee7f 100644
--- a/helm/charts/nats/test/defaults_test.go
+++ b/helm/charts/nats/test/defaults_test.go
@@ -29,7 +29,13 @@ type DynamicDefaultsGetter struct {
 	dd  DynamicDefaults
 }
 
-var ddg DynamicDefaultsGetter
+var (
+	ddg              DynamicDefaultsGetter
+	appProtocolTCP   = "tcp"
+	appProtocolTLS   = "tls"
+	appProtocolHTTP  = "http"
+	appProtocolHTTPS = "https"
+)
 
 func (d *DynamicDefaultsGetter) Get(t *testing.T) DynamicDefaults {
 	t.Helper()
@@ -159,14 +165,16 @@ func DefaultResources(t *testing.T, test *Test) *Resources {
 				Spec: corev1.ServiceSpec{
 					Ports: []corev1.ServicePort{
 						{
-							Name:       "nats",
-							Port:       4222,
-							TargetPort: intstr.FromString("nats"),
+							Name:        "nats",
+							Port:        4222,
+							TargetPort:  intstr.FromString("nats"),
+							AppProtocol: &appProtocolTCP,
 						},
 						{
-							Name:       "monitor",
-							Port:       8222,
-							TargetPort: intstr.FromString("monitor"),
+							Name:        "monitor",
+							Port:        8222,
+							TargetPort:  intstr.FromString("monitor"),
+							AppProtocol: &appProtocolHTTP,
 						},
 					},
 					Selector:                 natsSelectorLabels(),
@@ -392,9 +400,10 @@ exec sh -ec "$0"
 				Spec: corev1.ServiceSpec{
 					Ports: []corev1.ServicePort{
 						{
-							Name:       "nats",
-							Port:       4222,
-							TargetPort: intstr.FromString("nats"),
+							Name:        "nats",
+							Port:        4222,
+							TargetPort:  intstr.FromString("nats"),
+							AppProtocol: &appProtocolTCP,
 						},
 					},
 					Selector: natsSelectorLabels(),
diff --git a/helm/charts/nats/test/ports_test.go b/helm/charts/nats/test/ports_test.go
index 1bbf3c3a..6e7753fd 100644
--- a/helm/charts/nats/test/ports_test.go
+++ b/helm/charts/nats/test/ports_test.go
@@ -171,96 +171,112 @@ service:
 
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       1001,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        1001,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "leafnodes",
-			Port:       1002,
-			TargetPort: intstr.FromString("leafnodes"),
+			Name:        "leafnodes",
+			Port:        1002,
+			TargetPort:  intstr.FromString("leafnodes"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       1003,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        1003,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "mqtt",
-			Port:       1004,
-			TargetPort: intstr.FromString("mqtt"),
+			Name:        "mqtt",
+			Port:        1004,
+			TargetPort:  intstr.FromString("mqtt"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "cluster",
-			Port:       1005,
-			TargetPort: intstr.FromString("cluster"),
+			Name:        "cluster",
+			Port:        1005,
+			TargetPort:  intstr.FromString("cluster"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "gateway",
-			Port:       1006,
-			TargetPort: intstr.FromString("gateway"),
+			Name:        "gateway",
+			Port:        1006,
+			TargetPort:  intstr.FromString("gateway"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "monitor",
-			Port:       1007,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        1007,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "profiling",
-			Port:       1008,
-			TargetPort: intstr.FromString("profiling"),
+			Name:        "profiling",
+			Port:        1008,
+			TargetPort:  intstr.FromString("profiling"),
+			AppProtocol: &appProtocolTCP,
 		},
 	}
 
 	expected.Service.Value.Spec.Type = "NodePort"
 	expected.Service.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       3001,
-			NodePort:   4001,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        3001,
+			NodePort:    4001,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "leafnodes",
-			Port:       3002,
-			NodePort:   4002,
-			TargetPort: intstr.FromString("leafnodes"),
+			Name:        "leafnodes",
+			Port:        3002,
+			NodePort:    4002,
+			TargetPort:  intstr.FromString("leafnodes"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       3003,
-			NodePort:   4003,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        3003,
+			NodePort:    4003,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "mqtt",
-			Port:       3004,
-			NodePort:   4004,
-			TargetPort: intstr.FromString("mqtt"),
+			Name:        "mqtt",
+			Port:        3004,
+			NodePort:    4004,
+			TargetPort:  intstr.FromString("mqtt"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "cluster",
-			Port:       3005,
-			NodePort:   4005,
-			TargetPort: intstr.FromString("cluster"),
+			Name:        "cluster",
+			Port:        3005,
+			NodePort:    4005,
+			TargetPort:  intstr.FromString("cluster"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "gateway",
-			Port:       3006,
-			NodePort:   4006,
-			TargetPort: intstr.FromString("gateway"),
+			Name:        "gateway",
+			Port:        3006,
+			NodePort:    4006,
+			TargetPort:  intstr.FromString("gateway"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "monitor",
-			Port:       3007,
-			NodePort:   4007,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        3007,
+			NodePort:    4007,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "profiling",
-			Port:       3008,
-			NodePort:   4008,
-			TargetPort: intstr.FromString("profiling"),
+			Name:        "profiling",
+			Port:        3008,
+			NodePort:    4008,
+			TargetPort:  intstr.FromString("profiling"),
+			AppProtocol: &appProtocolTCP,
 		},
 	}
 
diff --git a/helm/charts/nats/test/resources_test.go b/helm/charts/nats/test/resources_test.go
index ea41cda5..5ae20392 100644
--- a/helm/charts/nats/test/resources_test.go
+++ b/helm/charts/nats/test/resources_test.go
@@ -333,19 +333,22 @@ natsBox:
 	expected.HeadlessService.Value.ObjectMeta.Namespace = "foo"
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "monitor",
-			Port:       8222,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        8222,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}
 
@@ -353,14 +356,16 @@ natsBox:
 	expected.Service.Value.ObjectMeta.Namespace = "foo"
 	expected.Service.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}
 
@@ -610,32 +615,37 @@ natsBox:
 
 	expected.HeadlessService.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 		{
-			Name:       "monitor",
-			Port:       8222,
-			TargetPort: intstr.FromString("monitor"),
+			Name:        "monitor",
+			Port:        8222,
+			TargetPort:  intstr.FromString("monitor"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}
 
 	expected.Service.Value.Spec.Ports = []corev1.ServicePort{
 		{
-			Name:       "nats",
-			Port:       4222,
-			TargetPort: intstr.FromString("nats"),
+			Name:        "nats",
+			Port:        4222,
+			TargetPort:  intstr.FromString("nats"),
+			AppProtocol: &appProtocolTCP,
 		},
 		{
-			Name:       "websocket",
-			Port:       8080,
-			TargetPort: intstr.FromString("websocket"),
+			Name:        "websocket",
+			Port:        8080,
+			TargetPort:  intstr.FromString("websocket"),
+			AppProtocol: &appProtocolHTTP,
 		},
 	}