diff --git a/modules/caddytls/tls.go b/modules/caddytls/tls.go
index 2ec7bd8f..bb4cd971 100644
--- a/modules/caddytls/tls.go
+++ b/modules/caddytls/tls.go
@@ -192,6 +192,13 @@ func (t *TLS) Provision(ctx caddy.Context) error {
 		if err != nil {
 			return fmt.Errorf("preparing 'ask' endpoint: %v", err)
 		}
+		perm := PermissionByHTTP{
+			Endpoint: t.Automation.OnDemand.Ask,
+		}
+		if err := perm.Provision(ctx); err != nil {
+			return fmt.Errorf("provisioning 'ask' module: %v", err)
+		}
+		t.Automation.OnDemand.permission = perm
 	}
 
 	// automation/management policies