diff --git a/helm/litellm/templates/_workload.tpl b/helm/litellm/templates/_workload.tpl
index 8f52cd52f2a..2b6b1434be9 100644
--- a/helm/litellm/templates/_workload.tpl
+++ b/helm/litellm/templates/_workload.tpl
@@ -507,7 +507,11 @@ spec:
       path: /metrics/
       interval: {{ .Values.gateway.serviceMonitor.interval }}
       scrapeTimeout: {{ .Values.gateway.serviceMonitor.scrapeTimeout }}
-      scheme: http
+      scheme: {{ .Values.gateway.serviceMonitor.scheme }}
+      {{- with .Values.gateway.serviceMonitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.gateway.serviceMonitor.relabelings }}
       relabelings:
         {{- toYaml . | nindent 8 }}
diff --git a/helm/litellm/tests/hpa_workload_metrics_tests.yaml b/helm/litellm/tests/hpa_workload_metrics_tests.yaml
index a6c17942a11..9b790070819 100644
--- a/helm/litellm/tests/hpa_workload_metrics_tests.yaml
+++ b/helm/litellm/tests/hpa_workload_metrics_tests.yaml
@@ -201,6 +201,32 @@ tests:
               scrapeTimeout: 10s
               scheme: http
 
+  - it: scrapes over https with the given tlsConfig, for a mesh with STRICT mTLS
+    template: gateway/servicemonitor.yaml
+    set:
+      gateway.serviceMonitor.enabled: true
+      gateway.metricsServer.enabled: true
+      gateway.serviceMonitor.scheme: https
+      gateway.serviceMonitor.tlsConfig:
+        caFile: /etc/prom-certs/root-cert.pem
+        certFile: /etc/prom-certs/cert-chain.pem
+        keyFile: /etc/prom-certs/key.pem
+        insecureSkipVerify: true
+    asserts:
+      - equal:
+          path: spec.endpoints
+          value:
+            - port: metrics
+              path: /metrics/
+              interval: 15s
+              scrapeTimeout: 10s
+              scheme: https
+              tlsConfig:
+                caFile: /etc/prom-certs/root-cert.pem
+                certFile: /etc/prom-certs/cert-chain.pem
+                keyFile: /etc/prom-certs/key.pem
+                insecureSkipVerify: true
+
   - it: carries litellm-helm annotations, relabelings and namespaceSelector onto the ServiceMonitor
     template: gateway/servicemonitor.yaml
     release:
diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml
index 9bfc3ca32e9..b4795cd9ca6 100644
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@@ -407,6 +407,8 @@ gateway:
     # Empty scrapes the release namespace.
     namespaceSelector:
       matchNames: []
+    scheme: http
+    tlsConfig: {}
   # Opt-in `collector` sidecar (same image, `python -m litellm.proxy.collector`)
   # that runs the post-response spend pipeline (cost calculation, spend logs,
   # spend counters, budget reservation reconciliation) so the uvicorn workers