diff --git a/charts/auth/templates/certificates.yaml b/charts/auth/templates/certificates.yaml
new file mode 100644
index 0000000..b6b54b7
--- /dev/null
+++ b/charts/auth/templates/certificates.yaml
@@ -0,0 +1,44 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: accounts-ui.{{ .Values.ui.domain }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  dnsNames:
+  - 'accounts-ui.{{ .Values.ui.domain }}'
+  issuerRef:
+    name: {{ .Values.ui.certificateIssuer }}
+    kind: ClusterIssuer
+  secretName: cert-accounts-ui.{{ .Values.ui.domain }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: accounts.{{ .Values.ui.domain }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  dnsNames:
+  - 'accounts.{{ .Values.ui.domain }}'
+  issuerRef:
+    name: {{ .Values.ui.certificateIssuer }}
+    kind: ClusterIssuer
+  secretName: cert-accounts.{{ .Values.ui.domain }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hydra.{{ .Values.ui.domain }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  dnsNames:
+  - 'hydra.{{ .Values.ui.domain }}'
+  issuerRef:
+    name: {{ .Values.ui.certificateIssuer }}
+    kind: ClusterIssuer
+  secretName: cert-hydra.{{ .Values.ui.domain }}
diff --git a/charts/auth/templates/ui.yaml b/charts/auth/templates/ui.yaml
index ee79d7e..8936f4d 100644
--- a/charts/auth/templates/ui.yaml
+++ b/charts/auth/templates/ui.yaml
@@ -18,16 +18,12 @@
 metadata:
   name: ui
   namespace: {{ .Release.Namespace }}
-  annotations:
-    cert-manager.io/cluster-issuer: {{ .Values.ui.certificateIssuer }}
-    acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
   ingressClassName: {{ .Values.ui.ingressClassName }}
   tls:
   - hosts:
     - accounts-ui.{{ .Values.ui.domain }}
     secretName: cert-accounts-ui.{{ .Values.ui.domain }}
-    # secretName: cert-wildcard.{{ .Values.ui.domain }}
   rules:
   - host: accounts-ui.{{ .Values.ui.domain }}
     http:
@@ -62,10 +58,6 @@
       - name: config
         configMap:
           name: {{ .Values.ui.nebula.lighthouse.name }}
-      hostAliases:
-      - ip: "111.0.0.1"
-        hostnames:
-          - "hydra.{{ .Values.ui.internalDomain }}"
       containers:
       - name: server
         image: giolekva/auth-ui:latest
diff --git a/charts/certificate-issuer/templates/wildcard-certificate-private.yaml b/charts/certificate-issuer/templates/wildcard-certificate-private.yaml
index 0300ce8..5d8c667 100644
--- a/charts/certificate-issuer/templates/wildcard-certificate-private.yaml
+++ b/charts/certificate-issuer/templates/wildcard-certificate-private.yaml
@@ -3,6 +3,8 @@
 metadata:
   name: wildcard-{{ .Values.private.domain }}
   namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/resource-policy: keep
 spec:
   dnsNames:
   - '*.{{ .Values.private.domain }}'
diff --git a/charts/certificate-issuer/templates/www-certificate-public.yaml b/charts/certificate-issuer/templates/www-certificate-public.yaml
index cb0c7ff..2216a94 100644
--- a/charts/certificate-issuer/templates/www-certificate-public.yaml
+++ b/charts/certificate-issuer/templates/www-certificate-public.yaml
@@ -3,6 +3,8 @@
 metadata:
   name: www-{{ .Values.public.domain }}
   namespace: {{ .Release.Namespace }}
+  annotations:
+    helm.sh/resource-policy: keep
 spec:
   dnsNames:
   - '{{ .Values.public.domain }}'
diff --git a/charts/maddy/templates/install.yaml b/charts/maddy/templates/install.yaml
index 6605094..e84ef16 100644
--- a/charts/maddy/templates/install.yaml
+++ b/charts/maddy/templates/install.yaml
@@ -68,7 +68,7 @@
   name: mail.{{ .Values.ingress.public.domain }}
   namespace: {{ .Release.Namespace }}
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
 spec:
   dnsNames:
   - 'mail.{{ .Values.ingress.public.domain }}'
diff --git a/charts/maddy/templates/mta-sts.yaml b/charts/maddy/templates/mta-sts.yaml
index bad3794..dd57797 100644
--- a/charts/maddy/templates/mta-sts.yaml
+++ b/charts/maddy/templates/mta-sts.yaml
@@ -17,7 +17,7 @@
   name: mta-sts.{{ .Values.ingress.public.domain }}
   namespace: {{ .Release.Namespace }}
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
 spec:
   dnsNames:
   - 'mta-sts.{{ .Values.ingress.public.domain }}'
diff --git a/charts/mail-gateway/templates/mx-certificate.yaml b/charts/mail-gateway/templates/mx-certificate.yaml
index c4012ae..2999b08 100644
--- a/charts/mail-gateway/templates/mx-certificate.yaml
+++ b/charts/mail-gateway/templates/mx-certificate.yaml
@@ -4,7 +4,7 @@
   name: {{ .Values.domains.primary.mx }}
   namespace: {{ .Release.Namespace }}
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
 spec:
   dnsNames:
   - {{ .Values.domains.primary.mx }}
diff --git a/charts/matrix/templates/matrix.yaml b/charts/matrix/templates/matrix.yaml
index e03223f..e400d33 100644
--- a/charts/matrix/templates/matrix.yaml
+++ b/charts/matrix/templates/matrix.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata: