diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index e1a01b9..4910e72 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -45,50 +45,6 @@
 
 ---
 
-{{- if .Values.serviceAccount.create }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "cert-manager.fullname" . }}-tokenrequest
-  namespace: {{ include "cert-manager.namespace" . }}
-  labels:
-    app: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/name: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: "controller"
-    {{- include "labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
-    verbs: ["create"]
-
----
-
-# grant cert-manager permission to create tokens for the serviceaccount
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "cert-manager.fullname" . }}-tokenrequest
-  namespace: {{ include "cert-manager.namespace" . }}
-  labels:
-    app: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/name: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: "controller"
-    {{- include "labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "cert-manager.fullname" . }}-tokenrequest
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "cert-manager.serviceAccountName" . }}
-    namespace: {{ include "cert-manager.namespace" . }}
-{{- end }}
-
----
-
 # Issuer controller role
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -515,15 +471,21 @@
     resources: ["certificates/status"]
     verbs: ["update"]
   {{- /*
-    Challenge and Order resources are not intended to be created or
-    modified directly by users.
+    Challenge and Order resources are not intended to be created by users
+    (GHSA-8rvj-mm4h-c258).
 
-    Challenges: "create" is excluded. "patch" and "update" are retained
-    because spec is immutable after creation (ValidateChallengeUpdate)
-    and because users need them to remove stuck finalizers
+    Challenges: "create" is excluded because a user-created Challenge with
+    attacker-controlled spec.solver can exfiltrate ClusterIssuer credentials
+    cross-namespace. "patch" and "update" are retained because spec is
+    immutable after creation (ValidateChallengeUpdate) so they cannot change
+    solver config, and because users need them to remove stuck finalizers
     (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
 
-    Orders: "create", "patch", and "update" are excluded.
+    Orders: "create", "patch", and "update" are excluded because a user
+    who can update an Order can change spec.issuerRef to reference a
+    different ClusterIssuer, then delete the Challenge; the Orders
+    controller recreates the Challenge with the attacker-chosen Issuer's
+    solver config, exfiltrating its credentials.
   */}}
   - apiGroups: ["acme.cert-manager.io"]
     resources: ["challenges"]