diff --git a/charts/external-secrets/templates/selfsigned-issuer.yaml b/charts/external-secrets/templates/selfsigned-issuer.yaml
new file mode 100644
index 0000000..b7bb562
--- /dev/null
+++ b/charts/external-secrets/templates/selfsigned-issuer.yaml
@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned
+  namespace: external-secrets
+spec:
+  selfSigned: {}
diff --git a/charts/external-secrets/values.yaml b/charts/external-secrets/values.yaml
index a1af09f..1e88e31 100644
--- a/charts/external-secrets/values.yaml
+++ b/charts/external-secrets/values.yaml
@@ -1,6 +1,7 @@
 # External Secrets Operator helm values
 # Uses EC2 instance role for AWS auth - no credentials needed
-# cert-manager handles webhook TLS instead of the built-in cert-controller
+# cert-manager handles webhook TLS with a self-signed issuer (internal cluster DNS,
+# not publicly routable - Let's Encrypt cannot issue for these names)
 installCRDs: true
 
 certController:
@@ -11,5 +12,5 @@ webhook:
     enabled: true
     cert:
       issuerRef:
-        name: letsencrypt-prod
-        kind: ClusterIssuer
+        name: selfsigned
+        kind: Issuer