diff --git a/apps/base/arrstack/arrproxy/gateway.yaml b/apps/base/arrstack/arrproxy/gateway.yaml
index b223d2d..a151d6d 100644
--- a/apps/base/arrstack/arrproxy/gateway.yaml
+++ b/apps/base/arrstack/arrproxy/gateway.yaml
@@ -1,9 +1,11 @@
 ---
 # External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
-# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
-# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
-# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
-# NOT external-dns, so no external-dns annotation here.
+# external Traefik (LB VIP 198.18.199.0). The apex arrstack.unkin.net A record
+# lives in the bind-operator unkin.net zone (bind-internal/authoritative), NOT
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -11,9 +13,6 @@ metadata:
     traefik.io/instance: external
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: arrstack.unkin.net
-    cert-manager.io/private-key-size: "4096"
   name: arrproxy
   namespace: arrstack
 spec:
@@ -38,4 +37,4 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: arrproxy-gateway-tls
+            name: wildcard-unkin-net-tls
diff --git a/apps/base/authentik/gateway.yaml b/apps/base/authentik/gateway.yaml
index bc13062..aa8892f 100644
--- a/apps/base/authentik/gateway.yaml
+++ b/apps/base/authentik/gateway.yaml
@@ -1,4 +1,9 @@
 ---
+# The public identity.unkin.net listener terminates TLS with the real Let's
+# Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected here as wildcard-unkin-net-tls). The cluster-hostname listeners
+# (identity.k8s.syd1.au.unkin.net) keep the Vault-PKI authentik-tls, whose
+# cert-manager annotations below now key the common-name off that cluster host.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -6,7 +11,7 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: identity.unkin.net
+    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
     external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
@@ -33,7 +38,7 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: authentik-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
     - allowedRoutes:
         namespaces:
diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
index c9cc74c..717357d 100644
--- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea"
   privateKey:
     size: 4096
   dnsNames: