diff --git a/k8s/argocd/apps/0-minio.yaml b/k8s/argocd/apps/0-minio.yaml
index 7b33729..141bbc9 100644
--- a/k8s/argocd/apps/0-minio.yaml
+++ b/k8s/argocd/apps/0-minio.yaml
@@ -1,5 +1,33 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
+metadata:
+  name: minio-operator
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/storage
+    directory:
+      recurse: false
+    helm:
+      valuesFiles:
+        - minio-operator-values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: minio-operator
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
 metadata:
   name: minio
   namespace: argocd
diff --git a/terraform/argocd-bootstrap.tf b/terraform/argocd-bootstrap.tf
index c472b14..98c07a8 100644
--- a/terraform/argocd-bootstrap.tf
+++ b/terraform/argocd-bootstrap.tf
@@ -44,6 +44,12 @@ resource "helm_release" "argocd" {
           enabled     = true
           minReplicas = 2
         }
+        env = [
+          {
+            name  = "GIT_SSL_CAINFO"
+            value = "/etc/ssl/certs/homelab-ca.crt"
+          }
+        ]
         volumes = [
           {
             name = "homelab-ca"
@@ -70,11 +76,8 @@ resource "helm_release" "argocd" {
     kubernetes_namespace.argocd
   ]
 
-  lifecycle {
-    ignore_changes = [
-      values
-    ]
-  }
+  # Note: lifecycle.ignore_changes removed to allow CA cert update
+  # This allows TF to inject the homelab-ca-secret for TLS verification
 }
 
 resource "kubernetes_manifest" "argocd_project" {
diff --git a/terraform/bootstrap-certificates.tf b/terraform/bootstrap-certificates.tf
deleted file mode 100644
index f6cbaa0..0000000
--- a/terraform/bootstrap-certificates.tf
+++ /dev/null
@@ -1,104 +0,0 @@
-resource "kubernetes_manifest" "selfsigned_bootstrap" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "ClusterIssuer"
-    metadata = {
-      name = "selfsigned-bootstrap"
-    }
-    spec = {
-      selfSigned = {}
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-}
-
-resource "kubernetes_manifest" "homelab_ca_cert" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "homelab-ca"
-      namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
-    }
-    spec = {
-      secretName = "homelab-ca-secret"
-      commonName = "homelab-ca"
-      isCA       = true
-      issuerRef = {
-        name = "selfsigned-bootstrap"
-        kind = "ClusterIssuer"
-      }
-      duration    = "87600h"
-      renewBefore = "720h"
-      privateKey = {
-        algorithm = "ECDSA"
-        size      = 256
-      }
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-
-  depends_on = [
-    kubernetes_manifest.selfsigned_bootstrap
-  ]
-}
-
-resource "kubernetes_manifest" "homelab_ca_issuer" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "ClusterIssuer"
-    metadata = {
-      name = "homelab-ca"
-    }
-    spec = {
-      ca = {
-        secretName = "homelab-ca-secret"
-      }
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-
-  depends_on = [
-    kubernetes_manifest.homelab_ca_cert
-  ]
-}
-
-resource "kubernetes_manifest" "wildcard_cert" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "homelab-tls"
-      namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
-    }
-    spec = {
-      secretName = "homelab-tls"
-      commonName = "*.${var.cluster_domain}"
-      dnsNames   = ["*.${var.cluster_domain}"]
-      issuerRef = {
-        name = "homelab-ca"
-        kind = "ClusterIssuer"
-      }
-      duration    = "2160h"
-      renewBefore = "720h"
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-
-  depends_on = [
-    kubernetes_manifest.homelab_ca_issuer,
-    kubernetes_namespace.namespaces
-  ]
-}