diff --git a/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml b/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml
index b60b29aa..12407833 100644
--- a/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml
+++ b/kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml
@@ -66,7 +66,7 @@ spec:
     sources: ["crd", "ingress"]
     txtPrefix: k8s.
     txtOwnerId: default
-    domainFilters: ["${SECRET_DOMAIN_INTERNAL}", "${SECRET_DOMAIN}"]
+    domainFilters: ["${SECRET_INTERNAL_DOMAIN}", "${SECRET_DOMAIN}"]
     serviceMonitor:
       enabled: true
     podAnnotations:
diff --git a/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml b/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml
index c5d0642c..16580feb 100644
--- a/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml
+++ b/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml
@@ -64,7 +64,7 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
+        default-ssl-certificate: "network/${SECRET_INTERNAL_DOMAIN/./-}-production-tls"
       resources:
         requests:
           cpu: 100m