diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml
index 3c6ee77..e5a20cd 100644
--- a/k8s/argocd/apps/00-substrate.yaml
+++ b/k8s/argocd/apps/00-substrate.yaml
@@ -88,9 +88,12 @@ spec:
   source:
     repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
+    # A real kustomization.yaml (resources: the 3 issuer/CA files) renders these
+    # deterministically. The previous directory.include with bare filenames
+    # rendered EMPTY — ArgoCD's include glob never matched — so this app silently
+    # tracked 0 resources; its ConfigMaps/Issuers only existed from bootstrap
+    # kubectl apply, and an automated prune wiped them.
     path: k8s/bootstrap/cert-manager
-    directory:
-      include: "letsencrypt-issuer.yaml,homelab-ca-issuer.yaml,homelab-ca-configmap.yaml"
   destination:
     server: https://kubernetes.default.svc
     namespace: cert-manager
@@ -98,6 +101,8 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
 ---
 # Consolidated: wildcard-cert + homelab-ingress → ingress-config
 # Manages both the wildcard TLS certificate and all Ingress rules.
diff --git a/k8s/bootstrap/cert-manager/kustomization.yaml b/k8s/bootstrap/cert-manager/kustomization.yaml
index e3b2849..8368ceb 100644
--- a/k8s/bootstrap/cert-manager/kustomization.yaml
+++ b/k8s/bootstrap/cert-manager/kustomization.yaml
@@ -1,5 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
-resources: []
-# cert-manager deployed via ArgoCD Helm source (see layer-2-bootstrap app)
+# Issuers + CA trust-bundle ConfigMaps for the cert-manager-issuers Application.
+# Each resource sets its own metadata.namespace (the ConfigMaps target iam/cicd/
+# monitoring/sqs; ClusterIssuers are cluster-scoped) — so NO namespace transformer
+# here (that would rewrite them all into one namespace). cert-manager itself is a
+# separate Helm Application; cert-manager-values.yaml here is only its $values ref.
+resources:
+  - letsencrypt-issuer.yaml
+  - homelab-ca-issuer.yaml
+  - homelab-ca-configmap.yaml