diff --git a/nomad/jenkins.nomad b/nomad/jenkins.nomad
index de0ead3..00659ed 100644
--- a/nomad/jenkins.nomad
+++ b/nomad/jenkins.nomad
@@ -13,6 +13,10 @@ job "jenkins" {
     value     = "true"
   }
 
+  vault {
+    policies    = ["default", "ansible"]
+    change_mode = "restart"
+  }
   group "jenkins" {
     count = 1
 
@@ -26,19 +30,41 @@ job "jenkins" {
         ]
       }
 
+      template {
+        data = <<EOH
+            {{- with secret "pki_int/issue/masked-dot-name" "common_name=jenkins.service.masked.name" "alt_names=jenkins.service.columbia.masked.name" -}}
+            {{- .Data.certificate -}}
+            {{- end -}}
+        EOH
+        destination   = "${NOMAD_SECRETS_DIR}/jenkins.crt"
+        change_mode   = "restart"
+      }
+
+      template {
+        data = <<EOH
+            {{- with secret "pki_int/issue/masked-dot-name" "common_name=jenkins.service.masked.name" "alt_names=jenkins.service.columbia.masked.name" -}}
+            {{- .Data.private_key -}}
+            {{- end -}}
+        EOH
+        destination   = "${NOMAD_SECRETS_DIR}/jenkins.key"
+        change_mode   = "restart"
+      }
+
       env {
-        ROOT_URL    = "${NOMAD_ADDR_https}"
+        ROOT_URL     = "${NOMAD_ADDR_https}"
+        JAVA_ARGS = "-Xmx2048m"
+        JENKINS_OPTS = "--httpsPort=8443 --httpsKeyStore=/secrets/jenkins.jks --httpsKeyStorePassword=password"
       }
 
       resources {
         cpu    = 2000
-        memory = 2048
+        memory = 2560
       }
     }
 
     network {
       port "https" {
-        to = 8080
+        to = 8443
        }
     }