diff --git a/templates/server-ingress.yaml b/templates/server-ingress.yaml
index 7c19f5fea..d2e525cc3 100644
--- a/templates/server-ingress.yaml
+++ b/templates/server-ingress.yaml
@@ -41,6 +41,12 @@ spec:
     - host: {{ .host | quote }}
       http:
         paths:
+        {{- range .extraBackends }}
+          - path: {{ .path }}
+            backend:
+              serviceName: {{ .serviceName }}
+              servicePort: {{ .servicePort }}
+        {{- end }}
         {{- range (.paths | default (list "/")) }}
           - path: {{ . }}
             backend:
diff --git a/test/unit/server-ingress.bats b/test/unit/server-ingress.bats
index 5af493847..fa54f0698 100755
--- a/test/unit/server-ingress.bats
+++ b/test/unit/server-ingress.bats
@@ -120,4 +120,21 @@ load _helpers
       . | tee /dev/stderr |
       yq -r '.spec.rules[0].http.paths[0].backend.serviceName' | tee /dev/stderr)
   [ "${actual}" = "RELEASE-NAME-vault" ]
-}
\ No newline at end of file
+}
+
+@test "server/ingress: adds extra backend workaround for ALB https redirection - yaml" {
+  cd `chart_dir`
+
+  local actual=$(helm template \
+      --show-only templates/server-ingress.yaml \
+      --set 'server.ingress.enabled=true' \
+      --set 'server.ingress.hosts[0].host=test.com' \
+      --set 'server.ingress.hosts[0].paths[0]=/' \
+      --set 'server.ingress.hosts[0].extraBackends[0].path=/' \
+      --set 'server.ingress.hosts[0].extraBackends[0].serviceName=ssl-redirect' \
+      --set 'server.ingress.hosts[0].extraBackends[0].servicePort=use-annotation' \
+      --set 'server.service.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.rules[0].http.paths[0].backend.serviceName' | tee /dev/stderr)
+  [ "${actual}" = "ssl-redirect" ]
+}
diff --git a/values.yaml b/values.yaml
index a0b77a5f8..3dc76c938 100644
--- a/values.yaml
+++ b/values.yaml
@@ -175,6 +175,14 @@ server:
     hosts:
       - host: chart-example.local
         paths: []
+        # Allow adding extra backend sections. This allows us to make use of
+        # the annotations required to do https redirection using AWS
+        # Application Load Balancers.
+        # See <https://github.com/hashicorp/vault-helm/issues/361>.
+        # extraBackends:
+        #   - path: /*
+        #     serviceName: ssl-redirect
+        #     servicePort: use-annotation
 
     tls: []
     #  - secretName: chart-example-tls