diff --git a/cluster/apps/default/hajimari/helm-release.yaml b/cluster/apps/default/hajimari/helm-release.yaml
index 9e38af94..9d12309a 100644
--- a/cluster/apps/default/hajimari/helm-release.yaml
+++ b/cluster/apps/default/hajimari/helm-release.yaml
@@ -113,7 +113,7 @@ spec:
         tls:
           - hosts:
               - "hajimari.${SECRET_DOMAIN}"
-            secretName: hajimari
+            secretName: "hajimari-${SECRET_DOMAIN/./-}-tls"
     persistence:
       data:
         enabled: true
diff --git a/cluster/apps/networking/kustomization.yaml b/cluster/apps/networking/kustomization.yaml
index 6974d391..8f492af6 100644
--- a/cluster/apps/networking/kustomization.yaml
+++ b/cluster/apps/networking/kustomization.yaml
@@ -2,4 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - traefik
-  - wildcard-certificate
diff --git a/cluster/apps/networking/traefik/dashboard/ingress.yaml b/cluster/apps/networking/traefik/dashboard/ingress.yaml
index 61483691..f9ff5413 100644
--- a/cluster/apps/networking/traefik/dashboard/ingress.yaml
+++ b/cluster/apps/networking/traefik/dashboard/ingress.yaml
@@ -14,7 +14,7 @@ spec:
   tls:
     - hosts:
         - "traefik.${SECRET_DOMAIN}"
-      secretName: "${SECRET_DOMAIN/./-}-tls"
+      secretName: "traefik-dashboard-${SECRET_DOMAIN/./-}-tls"
   rules:
     - host: "traefik.${SECRET_DOMAIN}"
       http:
@@ -25,4 +25,4 @@ spec:
               service:
                 name: traefik
                 port:
-                  number: 9000
\ No newline at end of file
+                  number: 9000
diff --git a/cluster/apps/networking/traefik/kustomization.yaml b/cluster/apps/networking/traefik/kustomization.yaml
index 8e03d43f..8b500613 100644
--- a/cluster/apps/networking/traefik/kustomization.yaml
+++ b/cluster/apps/networking/traefik/kustomization.yaml
@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helm-release.yaml
-  - tls-store
   - dashboard
diff --git a/cluster/apps/networking/traefik/tls-store/default.yaml b/cluster/apps/networking/traefik/tls-store/default.yaml
deleted file mode 100644
index 52a08394..00000000
--- a/cluster/apps/networking/traefik/tls-store/default.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: TLSStore
-metadata:
-  name: default
-  namespace: networking
-spec:
-  defaultCertificate:
-    secretName: "${SECRET_DOMAIN/./-}-tls"
diff --git a/cluster/apps/networking/traefik/tls-store/kustomization.yaml b/cluster/apps/networking/traefik/tls-store/kustomization.yaml
deleted file mode 100644
index 15aa7158..00000000
--- a/cluster/apps/networking/traefik/tls-store/kustomization.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - default.yaml
diff --git a/cluster/apps/networking/wildcard-certificate/certificate.yaml b/cluster/apps/networking/wildcard-certificate/certificate.yaml
deleted file mode 100644
index b877fa09..00000000
--- a/cluster/apps/networking/wildcard-certificate/certificate.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: "${SECRET_DOMAIN/./-}"
-  namespace: networking
-spec:
-  secretName: "${SECRET_DOMAIN/./-}-tls"
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "${SECRET_DOMAIN}"
-  dnsNames:
-    - "${SECRET_DOMAIN}"
-    - "*.${SECRET_DOMAIN}"
diff --git a/cluster/apps/networking/wildcard-certificate/kustomization.yaml b/cluster/apps/networking/wildcard-certificate/kustomization.yaml
deleted file mode 100644
index 1615af25..00000000
--- a/cluster/apps/networking/wildcard-certificate/kustomization.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - certificate.yaml
diff --git a/cluster/core/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml
index 43d01956..283a253e 100644
--- a/cluster/core/cert-manager/helm-release.yaml
+++ b/cluster/core/cert-manager/helm-release.yaml
@@ -20,12 +20,11 @@ spec:
     webhook:
       enabled: true
     extraArgs:
-      - --dns01-recursive-nameservers=1.1.1.1:53
+      - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
       - --dns01-recursive-nameservers-only
-    cainjector:
-      replicaCount: 1
+    replicaCount: 1
     podDnsPolicy: "None"
     podDnsConfig:
       nameservers:
         - "1.1.1.1"
-        - "8.8.8.8"
+        - "9.9.9.9"
diff --git a/cluster/core/cert-manager/letsencrypt-production.yaml b/cluster/core/cert-manager/letsencrypt-production.yaml
index a41666ca..348fc492 100644
--- a/cluster/core/cert-manager/letsencrypt-production.yaml
+++ b/cluster/core/cert-manager/letsencrypt-production.yaml
@@ -16,3 +16,6 @@ spec:
             apiTokenSecretRef:
               name: cloudflare-token-secret
               key: cloudflare-token
+        selector:
+          dnsZones:
+            - ${SECRET_DOMAIN}
diff --git a/cluster/core/cert-manager/letsencrypt-staging.yaml b/cluster/core/cert-manager/letsencrypt-staging.yaml
index e7ceb8f2..e9146701 100644
--- a/cluster/core/cert-manager/letsencrypt-staging.yaml
+++ b/cluster/core/cert-manager/letsencrypt-staging.yaml
@@ -16,3 +16,6 @@ spec:
             apiTokenSecretRef:
               name: cloudflare-token-secret
               key: cloudflare-token
+        selector:
+          dnsZones:
+            - ${SECRET_DOMAIN}