diff --git a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml
index dbc780f..8eff22e 100644
--- a/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml
@@ -2,6 +2,7 @@
 # Let's Encrypt *.ceph.unkin.net wildcard for the haproxy edge (ceph dashboard).
 # DNS-01 needs the delegated _acme-challenge.ceph.unkin.net CNAME in the public
 # unkin.net zone.
+# _acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
diff --git a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
index ba8f76c..bc34a2b 100644
--- a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
@@ -2,6 +2,7 @@
 # Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack,
 # jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated
 # _acme-challenge.main.unkin.net CNAME in the public unkin.net zone.
+# _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata: