diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml
index ee63acc..03e7600 100644
--- a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml
+++ b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml
@@ -11,9 +11,10 @@ spec:
       name: letsencrypt-staging-account-key
     solvers:
       - dns01:
-          # project must match the GCP project hosting the unkin.net Cloud DNS zone
-          cloudDNS:
-            project: REPLACE-WITH-GCP-PROJECT
-            serviceAccountSecretRef:
-              name: cert-manager-clouddns
-              key: key.json
+          rfc2136:
+            nameserver: "198.18.199.53:53"
+            tsigKeyName: certmanager
+            tsigAlgorithm: HMACSHA256
+            tsigSecretSecretRef:
+              name: certmanager-tsig
+              key: secret
diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml
index fc9dd11..b2950c7 100644
--- a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml
+++ b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml
@@ -11,9 +11,10 @@ spec:
       name: letsencrypt-account-key
     solvers:
       - dns01:
-          # project must match the GCP project hosting the unkin.net Cloud DNS zone
-          cloudDNS:
-            project: REPLACE-WITH-GCP-PROJECT
-            serviceAccountSecretRef:
-              name: cert-manager-clouddns
-              key: key.json
+          rfc2136:
+            nameserver: "198.18.199.53:53"
+            tsigKeyName: certmanager
+            tsigAlgorithm: HMACSHA256
+            tsigSecretSecretRef:
+              name: certmanager-tsig
+              key: secret
diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml
index d395bd2..33e1bc4 100644
--- a/apps/base/cert-manager/kustomization.yaml
+++ b/apps/base/cert-manager/kustomization.yaml
@@ -5,11 +5,8 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - serviceaccount.yaml
-  - serviceaccount_cert-manager-clouddns.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
   - vmservicescrape.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret_clouddns.yaml
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
diff --git a/apps/base/cert-manager/serviceaccount_cert-manager-clouddns.yaml b/apps/base/cert-manager/serviceaccount_cert-manager-clouddns.yaml
deleted file mode 100644
index 5514800..0000000
--- a/apps/base/cert-manager/serviceaccount_cert-manager-clouddns.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cert-manager-clouddns
-  namespace: cert-manager
-  labels:
-    app.kubernetes.io/name: cert-manager-config
-    app.kubernetes.io/instance: cert-manager-config
-    app.kubernetes.io/component: clouddns-solver
-automountServiceAccountToken: true
diff --git a/apps/base/cert-manager/vaultauth.yaml b/apps/base/cert-manager/vaultauth.yaml
deleted file mode 100644
index a9a2f35..0000000
--- a/apps/base/cert-manager/vaultauth.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: cert-manager
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cert-manager
-  kubernetes:
-    role: cert_manager_clouddns
-    serviceAccount: cert-manager-clouddns
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600
diff --git a/apps/base/cert-manager/vaultstaticsecret_clouddns.yaml b/apps/base/cert-manager/vaultstaticsecret_clouddns.yaml
deleted file mode 100644
index e7493a5..0000000
--- a/apps/base/cert-manager/vaultstaticsecret_clouddns.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: clouddns
-  namespace: cert-manager
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/cert-manager/clouddns
-  refreshAfter: 5m
-  destination:
-    name: cert-manager-clouddns
-    create: true