diff --git a/apps/base/cert-manager/clusterissuer_vault-issuer.yaml b/apps/base/cert-manager/clusterissuer_vault-issuer.yaml
new file mode 100644
index 0000000..4c3d20a
--- /dev/null
+++ b/apps/base/cert-manager/clusterissuer_vault-issuer.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vault-issuer
+  labels:
+    app.kubernetes.io/instance: cert-manager-config
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: cert-manager-config
+  annotations:
+    meta.helm.sh/release-name: cert-manager-clusterissuer
+    meta.helm.sh/release-namespace: cert-manager
+spec:
+  vault:
+    server: https://vault.service.consul:8200
+    path: pki_int/sign/servers_default
+    caBundleSecretRef:
+      key: ca.crt
+      name: vault-ca-cert
+    auth:
+      kubernetes:
+        mountPath: /v1/auth/k8s/au/syd1
+        role: cert_manager_issuer
+        serviceAccountRef:
+          name: cert-manager-vault-issuer
+          audiences:
+            - vault
diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml
index 33e1bc4..934cbc2 100644
--- a/apps/base/cert-manager/kustomization.yaml
+++ b/apps/base/cert-manager/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
+  - clusterissuer_vault-issuer.yaml
   - vmservicescrape.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml