diff --git a/app/covid-formity/prod.jsonnet b/app/covid-formity/prod.jsonnet
index 18fb845..44f83ef 100644
--- a/app/covid-formity/prod.jsonnet
+++ b/app/covid-formity/prod.jsonnet
@@ -93,7 +93,7 @@
         metadata+: app.metadata("covid-formity") {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 "nginx.ingress.kubernetes.io/configuration-snippet": "
                     location /qr1 { rewrite ^/qr1(.*)$ https://covid.hackerspace.pl$1 redirect; }
diff --git a/app/mastodon/kube/mastodon.libsonnet b/app/mastodon/kube/mastodon.libsonnet
index 04f673b..87ca055 100644
--- a/app/mastodon/kube/mastodon.libsonnet
+++ b/app/mastodon/kube/mastodon.libsonnet
@@ -283,7 +283,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/app/matrix/lib/matrix-ng.libsonnet b/app/matrix/lib/matrix-ng.libsonnet
index 037da0f..18120f0 100644
--- a/app/matrix/lib/matrix-ng.libsonnet
+++ b/app/matrix/lib/matrix-ng.libsonnet
@@ -365,7 +365,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 "nginx.ingress.kubernetes.io/use-regex": "true",
             },
diff --git a/app/matrix/lib/matrix.libsonnet b/app/matrix/lib/matrix.libsonnet
index 5d4c740..1990358 100644
--- a/app/matrix/lib/matrix.libsonnet
+++ b/app/matrix/lib/matrix.libsonnet
@@ -397,7 +397,7 @@
         metadata+: app.metadata("matrix") {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/app/onlyoffice/prod.jsonnet b/app/onlyoffice/prod.jsonnet
index aa80806..ea9958d 100644
--- a/app/onlyoffice/prod.jsonnet
+++ b/app/onlyoffice/prod.jsonnet
@@ -80,7 +80,7 @@
             metadata+: {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 },
             },
             spec+: {
diff --git a/bgpwtf/cccampix/kube/ix.libsonnet b/bgpwtf/cccampix/kube/ix.libsonnet
index 7496dad..a3521f8 100644
--- a/bgpwtf/cccampix/kube/ix.libsonnet
+++ b/bgpwtf/cccampix/kube/ix.libsonnet
@@ -429,7 +429,7 @@
             metadata+: ix.metadata("public") {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 },
             },
@@ -454,7 +454,7 @@
             metadata+: ix.metadata("alice") {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 },
             },
@@ -479,7 +479,7 @@
             metadata+: ix.metadata("grpc") {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     "kubernetes.io/ingress.class": "nginx",
                     "nginx.ingress.kubernetes.io/ssl-redirect": "true",
                     "nginx.ingress.kubernetes.io/backend-protocol": "GRPC",
diff --git a/bgpwtf/internet/kube/prod.jsonnet b/bgpwtf/internet/kube/prod.jsonnet
index 11a93c6..0644ab3 100644
--- a/bgpwtf/internet/kube/prod.jsonnet
+++ b/bgpwtf/internet/kube/prod.jsonnet
@@ -63,7 +63,7 @@
         metadata+: internet.metadata("frontend") {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
             },
         },
         spec+: {
diff --git a/bgpwtf/speedtest/kube/prod.jsonnet b/bgpwtf/speedtest/kube/prod.jsonnet
index 9187f54..6b57ce2 100644
--- a/bgpwtf/speedtest/kube/prod.jsonnet
+++ b/bgpwtf/speedtest/kube/prod.jsonnet
@@ -62,7 +62,7 @@
         metadata+: speedtest.metadata("public") {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/cluster/kube/cluster.libsonnet b/cluster/kube/cluster.libsonnet
index 8305033..0701305 100644
--- a/cluster/kube/cluster.libsonnet
+++ b/cluster/kube/cluster.libsonnet
@@ -127,7 +127,7 @@
                     verbs: ["*"],
                 },
                 {
-                    apiGroups: ["certmanager.k8s.io"],
+                    apiGroups: ["cert-manager.io/v1"],
                     resources: ["certificates"],
                     verbs: ["*"],
                 },
@@ -205,7 +205,9 @@
                     privateKeySecretRef: {
                         name: "letsencrypt-prod"
                     },
-                    http01: {},
+                    solvers: [
+                        { http01: { ingress: {} } },
+                    ]
                 },
             },
         },
diff --git a/cluster/kube/lib/registry.libsonnet b/cluster/kube/lib/registry.libsonnet
index 552d31b..d26d0fd 100644
--- a/cluster/kube/lib/registry.libsonnet
+++ b/cluster/kube/lib/registry.libsonnet
@@ -286,7 +286,7 @@
             metadata+: env.metadata("registry") {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS",
                     "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 },
diff --git a/cluster/kube/lib/rook.libsonnet b/cluster/kube/lib/rook.libsonnet
index 9a0f832..dba8234 100644
--- a/cluster/kube/lib/rook.libsonnet
+++ b/cluster/kube/lib/rook.libsonnet
@@ -757,7 +757,7 @@
             metadata+: cluster.metadata {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 },
             },
             spec+: {
@@ -1197,7 +1197,7 @@
             metadata+: zonegroup.realm.cluster.metadata {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 },
             },
diff --git a/devtools/gerrit/kube/gerrit.libsonnet b/devtools/gerrit/kube/gerrit.libsonnet
index 1a466bd..8d2c61b 100644
--- a/devtools/gerrit/kube/gerrit.libsonnet
+++ b/devtools/gerrit/kube/gerrit.libsonnet
@@ -194,7 +194,7 @@
         metadata+: gerrit.metadata("ingress") {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/devtools/issues/redmine.libsonnet b/devtools/issues/redmine.libsonnet
index 2080093..5e656db 100644
--- a/devtools/issues/redmine.libsonnet
+++ b/devtools/issues/redmine.libsonnet
@@ -134,7 +134,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
@@ -186,7 +186,7 @@
             metadata+: {
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     "nginx.ingress.kubernetes.io/proxy-body-size": "0",
                 },
             },
diff --git a/hswaw/oodviewer/prod.jsonnet b/hswaw/oodviewer/prod.jsonnet
index 914264b..e785808 100644
--- a/hswaw/oodviewer/prod.jsonnet
+++ b/hswaw/oodviewer/prod.jsonnet
@@ -64,7 +64,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/hswaw/paperless/paperless.libsonnet b/hswaw/paperless/paperless.libsonnet
index bed51e9..9f0ba4b 100644
--- a/hswaw/paperless/paperless.libsonnet
+++ b/hswaw/paperless/paperless.libsonnet
@@ -167,7 +167,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/kube/kube.libsonnet b/kube/kube.libsonnet
index 7e69720..f9615c0 100644
--- a/kube/kube.libsonnet
+++ b/kube/kube.libsonnet
@@ -3,13 +3,13 @@
 local kube = import "kube.upstream.libsonnet";
 
 kube {
-    ClusterIssuer(name): kube._Object("certmanager.k8s.io/v1alpha1", "ClusterIssuer", name) {
+    ClusterIssuer(name): kube._Object("cert-manager.io/v1", "ClusterIssuer", name) {
         spec: error "spec must be defined",
     },
-    Issuer(name): kube._Object("certmanager.k8s.io/v1alpha1", "Issuer", name) {
+    Issuer(name): kube._Object("cert-manager.io/v1", "Issuer", name) {
         spec: error "spec must be defined",
     },
-    Certificate(name): kube._Object("certmanager.k8s.io/v1alpha1", "Certificate", name) {
+    Certificate(name): kube._Object("cert-manager.io/v1", "Certificate", name) {
         spec: error "spec must be defined",
     },
     # For use in PodSpec.volumes_
diff --git a/kube/mirko.libsonnet b/kube/mirko.libsonnet
index 5203afd..4f7d501 100644
--- a/kube/mirko.libsonnet
+++ b/kube/mirko.libsonnet
@@ -55,7 +55,7 @@
                 },
                 annotations+: {
                     "kubernetes.io/tls-acme": "true",
-                    "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                    "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     [if env.ingressServerSnippet != null then "nginx.ingress.kubernetes.io/server-snippet"]: env.ingressServerSnippet,
                     [if std.length(env.extraHeaders) > 0 then "nginx.ingress.kubernetes.io/configuration-snippet"]:
                         std.join("\n", ["proxy_set_header %s;" % [h] for h in env.extraHeaders]),
diff --git a/ops/monitoring/lib/global.libsonnet b/ops/monitoring/lib/global.libsonnet
index 6ec9249..bd6bee3 100644
--- a/ops/monitoring/lib/global.libsonnet
+++ b/ops/monitoring/lib/global.libsonnet
@@ -138,7 +138,7 @@
                 metadata+: {
                     annotations+: {
                         "kubernetes.io/tls-acme": "true",
-                        "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     },
                 },
                 spec+: {
@@ -283,7 +283,7 @@
                 metadata+: {
                     annotations+: {
                         "kubernetes.io/tls-acme": "true",
-                        "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                     },
                 },
                 spec+: {
diff --git a/ops/sso/kube/sso.libsonnet b/ops/sso/kube/sso.libsonnet
index 26966bf..7b51c72 100644
--- a/ops/sso/kube/sso.libsonnet
+++ b/ops/sso/kube/sso.libsonnet
@@ -108,7 +108,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/personal/q3k/annoyatron/prod.jsonnet b/personal/q3k/annoyatron/prod.jsonnet
index dcd3679..c693cfd 100644
--- a/personal/q3k/annoyatron/prod.jsonnet
+++ b/personal/q3k/annoyatron/prod.jsonnet
@@ -51,7 +51,7 @@
             namespace: "q3k",
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
             },
         },
         spec+: {
diff --git a/personal/q3k/ppsa.jsonnet b/personal/q3k/ppsa.jsonnet
index 46eda70..60651c7 100644
--- a/personal/q3k/ppsa.jsonnet
+++ b/personal/q3k/ppsa.jsonnet
@@ -37,7 +37,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/personal/q3k/rc3.jsonnet b/personal/q3k/rc3.jsonnet
index 879e291..91f3969 100644
--- a/personal/q3k/rc3.jsonnet
+++ b/personal/q3k/rc3.jsonnet
@@ -37,7 +37,7 @@
             namespace: "personal-q3k",
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                 "nginx.ingress.kubernetes.io/proxy-body-size": "0",
             },
         },
diff --git a/personal/q3k/wow/lib.libsonnet b/personal/q3k/wow/lib.libsonnet
index 8828b49..d9ddc3d 100644
--- a/personal/q3k/wow/lib.libsonnet
+++ b/personal/q3k/wow/lib.libsonnet
@@ -276,7 +276,7 @@
         metadata+: {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
             },
         },
         spec+: {
diff --git a/personal/vuko/shells/prod.jsonnet b/personal/vuko/shells/prod.jsonnet
index 463087e..ed04483 100644
--- a/personal/vuko/shells/prod.jsonnet
+++ b/personal/vuko/shells/prod.jsonnet
@@ -141,7 +141,7 @@
         metadata+: shells.metadata("frontend") {
             annotations+: {
                 "kubernetes.io/tls-acme": "true",
-                "certmanager.k8s.io/cluster-issuer": "letsencrypt-prod",
+                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
             },
         },
         spec+: {