diff --git a/README.md b/README.md
index 4cbc27c0..9de6e901 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,23 @@ kubectl --kubeconfig=./kubeconfig get nodes
 # k8s-worker-a   Ready    worker                    4d20h   v1.20.5+k3s1
 ```
 
+### :cloud:  Cloudflare API Token
+
+In order to use cert-manager with the Cloudflare DNS challenge you will need to create a API token.
+
+1. Head over to Cloudflare and create a API token by going [here](https://dash.cloudflare.com/profile/api-tokens).
+2. Click the blue `Create Token` button
+3. Scroll down and create a Custom Token by choosing `Get started`
+4. Give your token a name like `cert-manager`
+5. Under `Permissions` give read access to `Zone` : `Zone` and `Zone` : `DNS`
+6. Under `Zone Resources` set it to `Include` : `All Zones`
+7. Click `Continue to summary` and then `Create Token`
+8. Export this token to an environment variable on your system to be used in the following steps
+
+```sh
+export BOOTSTRAP_CLOUDFLARE_TOKEN="kpG6iyg3FS_du_8KRShdFuwfbwu3zMltbvmJV6cD"
+```
+
 ### :small_blue_diamond:  GitOps with Flux
 
 Here we will be installing [flux](https://toolkit.fluxcd.io/) after some quick bootstrap steps.
@@ -152,8 +169,9 @@ Here we will be installing [flux](https://toolkit.fluxcd.io/) after some quick b
 ```sh
 flux check --pre
 # ► checking prerequisites
-# ✗ kubectl version v0.0.0-master+faecb196815 < >=1.18.0-0
+# ✔ kubectl 1.21.0 >=1.18.0-0
 # ✔ Kubernetes 1.20.5+k3s1 >=1.16.0-0
+# ✔ prerequisites checks passed
 ```
 
 2. Pre-create the `flux-system` namespace
@@ -174,12 +192,11 @@ kubectl --kubeconfig=./kubeconfig create secret generic sops-gpg \
 4. Update files using `envsubst` or by updating the files listed below manually
 
 ```sh
-export BOOTSTRAP_GITHUB_REPOSITORY="k8s-at-home/home-cluster"
+export BOOTSTRAP_GITHUB_REPOSITORY="https://github.com/k8s-at-home/home-cluster"
 export BOOTSTRAP_METALLB_LB_RANGE="169.254.1.10-169.254.1.20"
 export BOOTSTRAP_DOMAIN="k8s-at-home.com"
 export BOOTSTRAP_DOMAIN_CERT="k8s-at-home"
 export BOOTSTRAP_CLOUDFLARE_EMAIL="k8s-at-home@gmail.com"
-export BOOTSTRAP_CLOUDFLARE_TOKEN="dsKq41iLAbXE37GV"
 export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10"
 
 envsubst < ./tmpl/.sops.yaml > ./.sops.yaml
diff --git a/cluster/core/cert-manager/letsencrypt-production.yaml b/cluster/core/cert-manager/letsencrypt-production.yaml
index e2efbfe5..943854df 100644
--- a/cluster/core/cert-manager/letsencrypt-production.yaml
+++ b/cluster/core/cert-manager/letsencrypt-production.yaml
@@ -13,6 +13,6 @@ spec:
     - dns01:
         cloudflare:
           email: "${SECRET_CLOUDFLARE_EMAIL}"
-          apiKeySecretRef:
+          apiTokenSecretRef:
             name: cloudflare-token-secret
             key: cloudflare-token
diff --git a/cluster/core/cert-manager/letsencrypt-staging.yaml b/cluster/core/cert-manager/letsencrypt-staging.yaml
index a92ebcb6..8e074534 100644
--- a/cluster/core/cert-manager/letsencrypt-staging.yaml
+++ b/cluster/core/cert-manager/letsencrypt-staging.yaml
@@ -13,6 +13,6 @@ spec:
     - dns01:
         cloudflare:
           email: "${SECRET_CLOUDFLARE_EMAIL}"
-          apiKeySecretRef:
+          apiTokenSecretRef:
             name: cloudflare-token-secret
             key: cloudflare-token
diff --git a/tmpl/gotk-sync.yaml b/tmpl/gotk-sync.yaml
index 8ac104ce..a50dc5d1 100644
--- a/tmpl/gotk-sync.yaml
+++ b/tmpl/gotk-sync.yaml
@@ -8,9 +8,7 @@ spec:
   interval: 1m0s
   ref:
     branch: main
-  secretRef:
-    name: flux-system
-  url: ssh://git@github.com/$BOOTSTRAP_GITHUB_REPOSITORY
+  url: $BOOTSTRAP_GITHUB_REPOSITORY
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
 kind: Kustomization