diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml
index 3c6ee77..50d742f 100644
--- a/k8s/argocd/apps/00-substrate.yaml
+++ b/k8s/argocd/apps/00-substrate.yaml
@@ -95,9 +95,12 @@ spec:
     server: https://kubernetes.default.svc
     namespace: cert-manager
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
+    # automated sync intentionally disabled: ArgoCD directory.include renders
+    # this app's resources as EMPTY (root cause under investigation), so an
+    # automated prune wipes the ClusterIssuers + homelab-ca ConfigMaps. Keep
+    # manual until the render is fixed, then restore prune/selfHeal.
+    syncOptions:
+      - CreateNamespace=true
 ---
 # Consolidated: wildcard-cert + homelab-ingress → ingress-config
 # Manages both the wildcard TLS certificate and all Ingress rules.