diff --git a/charts/cert-manager/.helmignore b/charts/cert-manager/.helmignore
new file mode 100644
index 0000000..2d561ac
--- /dev/null
+++ b/charts/cert-manager/.helmignore
@@ -0,0 +1,26 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+
+README.template.md
+OWNERS
+cert-manager*.tgz
+tests/
diff --git a/charts/cert-manager/Chart.yaml b/charts/cert-manager/Chart.yaml
index b139024..cebf3b4 100644
--- a/charts/cert-manager/Chart.yaml
+++ b/charts/cert-manager/Chart.yaml
@@ -6,7 +6,7 @@
     fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
     url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
 apiVersion: v2
-appVersion: v1.20.3
+appVersion: v1.21.0
 description: A Helm chart for cert-manager
 home: https://cert-manager.io
 icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
@@ -23,4 +23,4 @@
 name: cert-manager
 sources:
 - https://github.com/cert-manager/cert-manager
-version: v1.20.3
+version: v1.21.0
diff --git a/charts/cert-manager/README.md b/charts/cert-manager/README.md
index bba0bc8..18fc9ed 100644
--- a/charts/cert-manager/README.md
+++ b/charts/cert-manager/README.md
@@ -8,7 +8,9 @@
 
 ## Prerequisites
 
-- Kubernetes 1.22+
+Make sure you are using a version of Kubernetes that is supported by
+cert-manager. For more information, see the [Supported Releases
+page](https://cert-manager.io/docs/releases/).
 
 ## Installing the Chart
 
@@ -18,15 +20,11 @@
 To install the chart with the release name `cert-manager`:
 
 ```console
-# Add the Jetstack Helm repository
-helm repo add jetstack https://charts.jetstack.io --force-update
-
-# Install the cert-manager helm chart
 helm install \
-  cert-manager jetstack/cert-manager \
+  cert-manager oci://quay.io/jetstack/charts/cert-manager \
   --namespace cert-manager \
   --create-namespace \
-  --version v1.20.3 \
+  --version v1.21.0 \
   --set crds.enabled=true
 ```
 
@@ -112,9 +110,9 @@
 > ```
 
 Labels to apply to all resources.  
-Please note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).  
-For example, secretTemplate in CertificateSpec  
-For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
+These labels are also applied to dynamically-created ACME HTTP01 solver resources  
+(pods, services, ingresses, or Gateway API HTTPRoutes).  
+The following ACME identity label keys are reserved and will be silently ignored on dynamically-created resources: acme.cert-manager.io/http-domain, acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver. For per-Issuer-specific labels, use the HTTP01 ingress solver podTemplate and ingressTemplate fields for pod/ingress resources, or the gatewayHTTPRoute solver labels field for Gateway API HTTPRoute resources.
 #### **global.revisionHistoryLimit** ~ `number`
 
 The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
@@ -194,6 +192,20 @@
 
 The duration the clients should wait between attempting acquisition and renewal of a leadership.
 
+#### **global.runtimeClassName** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).  
+  
+For example:
+
+```yaml
+runtimeClassName: gvisor
+```
+
 #### **installCRDs** ~ `bool`
 > Default value:
 > ```yaml
@@ -439,7 +451,8 @@
   kubernetesAPIQPS: 9000
   kubernetesAPIBurst: 9000
   numberOfConcurrentWorkers: 200
-  enableGatewayAPI: true
+  gatewayAPI:
+    enable: true
   # Feature gates as of v1.20.0. Listed with their default values.
   # See https://cert-manager.io/docs/cli/controller/
   featureGates:
@@ -470,6 +483,9 @@
     maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)
     maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)
     maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)
+  # Configure certificate request backoff durations
+  certificateRequestMinimumBackoffDuration: 1h
+  certificateRequestMaximumBackoffDuration: 32h
 ```
 #### **dns01RecursiveNameservers** ~ `string`
 > Default value:
@@ -764,6 +780,20 @@
          values:
          - master
 ```
+#### **runtimeClassName** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).  
+  
+For example:
+
+```yaml
+runtimeClassName: gvisor
+```
+
 #### **tolerations** ~ `array`
 > Default value:
 > ```yaml
@@ -853,21 +883,6 @@
 > ```
 
 Specifies the `prometheus` label on the created ServiceMonitor. This is used when different Prometheus instances have label selectors matching different ServiceMonitors.
-#### **prometheus.servicemonitor.targetPort** ~ `string,integer`
-> Default value:
-> ```yaml
-> http-metrics
-> ```
-
-The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics.
-
-#### **prometheus.servicemonitor.path** ~ `string`
-> Default value:
-> ```yaml
-> /metrics
-> ```
-
-The path to scrape for metrics.
 #### **prometheus.servicemonitor.interval** ~ `string`
 > Default value:
 > ```yaml
@@ -942,13 +957,6 @@
 > ```
 
 Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.
-#### **prometheus.podmonitor.path** ~ `string`
-> Default value:
-> ```yaml
-> /metrics
-> ```
-
-The path to scrape for metrics.
 #### **prometheus.podmonitor.interval** ~ `string`
 > Default value:
 > ```yaml
@@ -1277,6 +1285,20 @@
          values:
          - master
 ```
+#### **webhook.runtimeClassName** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).  
+  
+For example:
+
+```yaml
+runtimeClassName: gvisor
+```
+
 #### **webhook.tolerations** ~ `array`
 > Default value:
 > ```yaml
@@ -1776,6 +1798,20 @@
          values:
          - master
 ```
+#### **cainjector.runtimeClassName** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).  
+  
+For example:
+
+```yaml
+runtimeClassName: gvisor
+```
+
 #### **cainjector.tolerations** ~ `array`
 > Default value:
 > ```yaml
@@ -1961,6 +1997,20 @@
 > ```
 
 Kubernetes imagePullPolicy on Deployment.
+#### **acmesolver.runtimeClassName** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).  
+  
+For example:
+
+```yaml
+runtimeClassName: gvisor
+```
+
 ### Startup API Check
 
 
@@ -2008,6 +2058,11 @@
 > ```
 
 Job backoffLimit
+#### **startupapicheck.ttlSecondsAfterFinished** ~ `integer`
+
+Limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, once the Job finishes, it will be automatically cleaned up after ttlSecondsAfterFinished seconds. This is disabled by default (field is not set) to preserve backward compatibility and avoid issues with GitOps tools (e.g. Argo CD) that may attempt to reconcile or recreate Jobs after they are automatically deleted. For more information, see [Automatic Cleanup for Finished Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/).
+
+
 #### **startupapicheck.jobAnnotations** ~ `object`
 > Default value:
 > ```yaml
@@ -2052,7 +2107,7 @@
 > {}
 > ```
 
-Resources to provide to the cert-manager controller pod.  
+Resources to provide to the cert-manager startupapicheck pod.  
   
 For example:
 
@@ -2093,6 +2148,20 @@
          values:
          - master
 ```
+#### **startupapicheck.runtimeClassName** ~ `string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).  
+  
+For example:
+
+```yaml
+runtimeClassName: gvisor
+```
+
 #### **startupapicheck.tolerations** ~ `array`
 > Default value:
 > ```yaml
diff --git a/charts/cert-manager/templates/_helpers.tpl b/charts/cert-manager/templates/_helpers.tpl
index c58adeb..83d844f 100644
--- a/charts/cert-manager/templates/_helpers.tpl
+++ b/charts/cert-manager/templates/_helpers.tpl
@@ -179,7 +179,7 @@
 Any changes to this function should also be made in cert-manager, trust-manager, approver-policy, ...
 See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
 */}}
-{{- define "image" -}}
+{{- define "cert-manager.image" -}}
 {{- /*
 Calling convention:
 
@@ -191,7 +191,7 @@
 */ -}}
 
 {{- if ne (len .) 4 -}}
-    {{- fail (printf "ERROR: template \"image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
+    {{- fail (printf "ERROR: template \"cert-manager.image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
 {{- end -}}
 
 {{- $image := index . 0 -}}
diff --git a/charts/cert-manager/templates/cainjector-deployment.yaml b/charts/cert-manager/templates/cainjector-deployment.yaml
index 89f6afe..6b097f0 100644
--- a/charts/cert-manager/templates/cainjector-deployment.yaml
+++ b/charts/cert-manager/templates/cainjector-deployment.yaml
@@ -76,7 +76,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-cainjector
-          image: "{{ template "image" (tuple .Values.cainjector.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+          image: "{{ template "cert-manager.image" (tuple .Values.cainjector.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
           args:
           {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -151,6 +151,11 @@
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.cainjector.runtimeClassName }}
+      runtimeClassName: {{ .Values.cainjector.runtimeClassName | quote }}
+      {{- else if .Values.global.runtimeClassName }}
+      runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+      {{- end }}
       {{- with .Values.cainjector.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
index 039062d..baf9190 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
@@ -3215,6 +3215,24 @@
                             this challenge solver will apply to.
                           type: object
                       type: object
+                    waitInsteadOfSelfCheck:
+                      description: |-
+                        WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+                        instead waits this long after presentation before asking the ACME server
+                        to validate the challenge.
+
+                        This is an advanced escape hatch for environments where cert-manager's
+                        self-check cannot succeed from its own network or DNS viewpoint even
+                        though the ACME server can still validate successfully, for example due
+                        to split-horizon DNS or NAT hairpinning.
+
+                        A value of 0 skips the self-check and asks the ACME server to validate
+                        immediately after presentation, relying on the ACME server's own
+                        validation retries (RFC 8555 section 8.2) to succeed once the challenge
+                        has propagated. A negative duration is rejected.
+                        Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+                        for example `30s` or `2m`.
+                      type: string
                   type: object
                 token:
                   description: |-
@@ -3253,13 +3271,21 @@
               properties:
                 presented:
                   description: |-
-                    presented will be set to true if the challenge values for this challenge
-                    are currently 'presented'.
-                    This *does not* imply the self check is passing. Only that the values
-                    have been 'submitted' for the appropriate challenge mechanism (i.e. the
-                    DNS01 TXT record has been presented, or the HTTP01 configuration has been
-                    configured).
+                    Presented is true once cert-manager has configured the solver resources
+                    needed to expose this challenge's validation material.
+                    For example, the DNS01 TXT record has been created, or the HTTP01 solver
+                    has been configured to serve the challenge token.
+                    This does not imply the self check is passing, that the ACME server has
+                    validated the challenge, or that cert-manager has already accepted the
+                    challenge with the ACME server.
                   type: boolean
+                presentedAt:
+                  description: |-
+                    PresentedAt records when cert-manager first configured the solver
+                    resources for this challenge. This is used by the optional delay-based
+                    readiness logic.
+                  format: date-time
+                  type: string
                 processing:
                   description: |-
                     Used to denote whether this challenge should be processed or not.
diff --git a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
index 59596e7..d64e5d6 100644
--- a/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
+++ b/charts/cert-manager/templates/crd-acme.cert-manager.io_orders.yaml
@@ -79,7 +79,7 @@
                 duration:
                   description: |-
                     Duration is the duration for the not after date for the requested certificate.
-                    this is set on order creation as pe the ACME spec.
+                    This is set on order creation as per the ACME spec.
                   type: string
                 ipAddresses:
                   description: |-
@@ -119,6 +119,15 @@
                     Profile allows requesting a certificate profile from the ACME server.
                     Supported profiles are listed by the server's ACME directory URL.
                   type: string
+                replaces:
+                  description: |-
+                    Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this
+                    Order is intended to replace. When set, cert-manager will include the
+                    "replaces" field on the newOrder request to the ACME server if and only
+                    if the server advertises ARI support in its directory. The CertID has
+                    the form "base64url(AKI).base64url(serial)" and is derived locally from
+                    the currently issued leaf certificate.
+                  type: string
                 request:
                   description: |-
                     Certificate signing request bytes in DER encoding.
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
index 7ebc08e..c77f7da 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_certificates.yaml
@@ -286,10 +286,16 @@
                             `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
                             (e.g., because of company policy). Please note that the security of the algorithm is not that important
                             in reality, because the unencrypted certificate and private key are also stored in the Secret.
+                            `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.
+                            Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.
+                            The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.
+                            Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,
+                            or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.
                           enum:
                             - LegacyRC2
                             - LegacyDES
                             - Modern2023
+                            - Modern2026
                           type: string
                       required:
                         - create
@@ -502,6 +508,53 @@
                     Cannot be set if the `renewBefore` field is set.
                   format: int32
                   type: integer
+                renewal:
+                  description: |-
+                    `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is
+                    `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.
+                  properties:
+                    policy:
+                      description: '`policy` must be one of `Disabled`, `RenewBefore`.'
+                      enum:
+                        - RenewBefore
+                        - Disabled
+                      type: string
+                    windows:
+                      description: '`windows` mentions the behavior of when the renewal must happen.'
+                      items:
+                        description: CertificateRenewalWindows is the definition for renewal windows
+                        properties:
+                          cron:
+                            description: |-
+                              `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:
+                              * * * * *
+                              | | | | |
+                              | | | | day of the week (0–6) (Sunday to Saturday;
+                              | | | month (1–12)             7 is also Sunday on some systems)
+                              | | day of the month (1–31)
+                              | hour (0–23)
+                              minute (0–59)
+                            minLength: 1
+                            type: string
+                          timezone:
+                            description: |-
+                              `timezone` is IANA compliant timezone. For example America/Denver.
+                              If this field is not set, timezone is treated as UTC.
+                            minLength: 1
+                            type: string
+                          windowDuration:
+                            description: |-
+                              `windowDuration` is how long the cron definition is active for.
+                              Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+                            pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$
+                            type: string
+                        required:
+                          - cron
+                          - windowDuration
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  type: object
                 revisionHistoryLimit:
                   description: |-
                     The maximum number of CertificateRequest revisions that are maintained in
@@ -692,6 +745,47 @@
                 Read-only.
                 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
               properties:
+                acme:
+                  description: ACME stores information that is fetched from the ACME CA server.
+                  properties:
+                    ari:
+                      description: |-
+                        ARI stores the ACME Renewal Information that is fetched from the ACME server
+                        in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.
+                      properties:
+                        explanationURL:
+                          description: |-
+                            ExplanationURL is a human-readable URL that may explain why the suggested window
+                            has its current value.
+                          type: string
+                        lastChecked:
+                          description: LastChecked is the time at which the ACME server was last checked for renewal information.
+                          format: date-time
+                          type: string
+                        lastError:
+                          description: LastError is the last error encountered when checking the ACME server for renewal information, if any.
+                          type: string
+                        nextCheck:
+                          description: NextCheck is the time at which the ACME server will next be checked for renewal information.
+                          format: date-time
+                          type: string
+                        suggestedWindow:
+                          description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.
+                          properties:
+                            end:
+                              description: End is the end of the suggested renewal window.
+                              format: date-time
+                              type: string
+                            start:
+                              description: Start is the start of the suggested renewal window.
+                              format: date-time
+                              type: string
+                          required:
+                            - end
+                            - start
+                          type: object
+                      type: object
+                  type: object
                 conditions:
                   description: |-
                     List of status conditions to indicate the status of certificates.
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
index f5de226..6b401c4 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml
@@ -3328,6 +3328,24 @@
                                   this challenge solver will apply to.
                                 type: object
                             type: object
+                          waitInsteadOfSelfCheck:
+                            description: |-
+                              WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+                              instead waits this long after presentation before asking the ACME server
+                              to validate the challenge.
+
+                              This is an advanced escape hatch for environments where cert-manager's
+                              self-check cannot succeed from its own network or DNS viewpoint even
+                              though the ACME server can still validate successfully, for example due
+                              to split-horizon DNS or NAT hairpinning.
+
+                              A value of 0 skips the self-check and asks the ACME server to validate
+                              immediately after presentation, relying on the ACME server's own
+                              validation retries (RFC 8555 section 8.2) to succeed once the challenge
+                              has propagated. A negative duration is rejected.
+                              Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+                              for example `30s` or `2m`.
+                            type: string
                         type: object
                       type: array
                       x-kubernetes-list-type: atomic
@@ -3442,6 +3460,62 @@
                             - roleId
                             - secretRef
                           type: object
+                        aws:
+                          description: |-
+                            AWS authenticates with Vault using AWS IAM authentication.
+                            This allows authentication using IAM roles for service accounts (IRSA),
+                            EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+                          properties:
+                            iamRoleArn:
+                              description: |-
+                                The ARN of the AWS IAM role to assume using the Kubernetes service account
+                                token. Required when using IRSA (serviceAccountRef is set).
+                                This role must have a trust policy that allows the OIDC provider to assume it.
+                              type: string
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/aws" will be used.
+                              type: string
+                            region:
+                              description: |-
+                                The AWS region to use for authentication. If not specified, the region
+                                will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+                                variables, falling back to "us-east-1" if not set.
+                              type: string
+                            role:
+                              description: A required field containing the Vault Role to assume when authenticating.
+                              minLength: 1
+                              type: string
+                            serviceAccountRef:
+                              description: |-
+                                A reference to a service account that will be used to request a web identity
+                                token for IRSA (IAM Roles for Service Accounts) authentication.
+                              properties:
+                                audiences:
+                                  description: |-
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+                                    The default audiences are always included in the token.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  description: Name of the ServiceAccount used to request a token.
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            vaultHeaderValue:
+                              description: |-
+                                The Vault header value to include in the STS signing request.
+                                This is used to prevent replay attacks.
+                              type: string
+                          required:
+                            - role
+                          type: object
                         clientCertificate:
                           description: |-
                             ClientCertificate authenticates with Vault by presenting a client
@@ -3676,6 +3750,46 @@
                       required:
                         - apiTokenSecretRef
                       type: object
+                    ngts:
+                      description: |-
+                        NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+                        using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+                      properties:
+                        credentialsRef:
+                          description: |-
+                            CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+                            Client ID and Client Secret. The secret must contain the keys 'client-id' and
+                            'client-secret'.
+                          properties:
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        tokenEndpoint:
+                          description: |-
+                            TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+                            for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+                            Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+                          type: string
+                        tsgID:
+                          description: |-
+                            TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+                            for example "1234567890". The tsg_id: prefix is added automatically.
+                            This field is required.
+                          type: string
+                        url:
+                          description: |-
+                            URL is the base URL for the NGTS API endpoint.
+                            Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+                          type: string
+                      required:
+                        - credentialsRef
+                        - tsgID
+                      type: object
                     tpp:
                       description: |-
                         TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -3744,6 +3858,9 @@
                   required:
                     - zone
                   type: object
+                  x-kubernetes-validations:
+                    - message: exactly one of tpp, cloud, or ngts must be configured
+                      rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
               type: object
             status:
               description: Status of the ClusterIssuer. This is set and managed automatically.
diff --git a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
index 68a2dd0..0bb87b7 100644
--- a/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
+++ b/charts/cert-manager/templates/crd-cert-manager.io_issuers.yaml
@@ -3327,6 +3327,24 @@
                                   this challenge solver will apply to.
                                 type: object
                             type: object
+                          waitInsteadOfSelfCheck:
+                            description: |-
+                              WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+                              instead waits this long after presentation before asking the ACME server
+                              to validate the challenge.
+
+                              This is an advanced escape hatch for environments where cert-manager's
+                              self-check cannot succeed from its own network or DNS viewpoint even
+                              though the ACME server can still validate successfully, for example due
+                              to split-horizon DNS or NAT hairpinning.
+
+                              A value of 0 skips the self-check and asks the ACME server to validate
+                              immediately after presentation, relying on the ACME server's own
+                              validation retries (RFC 8555 section 8.2) to succeed once the challenge
+                              has propagated. A negative duration is rejected.
+                              Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+                              for example `30s` or `2m`.
+                            type: string
                         type: object
                       type: array
                       x-kubernetes-list-type: atomic
@@ -3441,6 +3459,62 @@
                             - roleId
                             - secretRef
                           type: object
+                        aws:
+                          description: |-
+                            AWS authenticates with Vault using AWS IAM authentication.
+                            This allows authentication using IAM roles for service accounts (IRSA),
+                            EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+                          properties:
+                            iamRoleArn:
+                              description: |-
+                                The ARN of the AWS IAM role to assume using the Kubernetes service account
+                                token. Required when using IRSA (serviceAccountRef is set).
+                                This role must have a trust policy that allows the OIDC provider to assume it.
+                              type: string
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/aws" will be used.
+                              type: string
+                            region:
+                              description: |-
+                                The AWS region to use for authentication. If not specified, the region
+                                will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+                                variables, falling back to "us-east-1" if not set.
+                              type: string
+                            role:
+                              description: A required field containing the Vault Role to assume when authenticating.
+                              minLength: 1
+                              type: string
+                            serviceAccountRef:
+                              description: |-
+                                A reference to a service account that will be used to request a web identity
+                                token for IRSA (IAM Roles for Service Accounts) authentication.
+                              properties:
+                                audiences:
+                                  description: |-
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+                                    The default audiences are always included in the token.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  description: Name of the ServiceAccount used to request a token.
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            vaultHeaderValue:
+                              description: |-
+                                The Vault header value to include in the STS signing request.
+                                This is used to prevent replay attacks.
+                              type: string
+                          required:
+                            - role
+                          type: object
                         clientCertificate:
                           description: |-
                             ClientCertificate authenticates with Vault by presenting a client
@@ -3675,6 +3749,46 @@
                       required:
                         - apiTokenSecretRef
                       type: object
+                    ngts:
+                      description: |-
+                        NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+                        using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+                      properties:
+                        credentialsRef:
+                          description: |-
+                            CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+                            Client ID and Client Secret. The secret must contain the keys 'client-id' and
+                            'client-secret'.
+                          properties:
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        tokenEndpoint:
+                          description: |-
+                            TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+                            for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+                            Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+                          type: string
+                        tsgID:
+                          description: |-
+                            TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+                            for example "1234567890". The tsg_id: prefix is added automatically.
+                            This field is required.
+                          type: string
+                        url:
+                          description: |-
+                            URL is the base URL for the NGTS API endpoint.
+                            Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+                          type: string
+                      required:
+                        - credentialsRef
+                        - tsgID
+                      type: object
                     tpp:
                       description: |-
                         TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -3743,6 +3857,9 @@
                   required:
                     - zone
                   type: object
+                  x-kubernetes-validations:
+                    - message: exactly one of tpp, cloud, or ngts must be configured
+                      rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
               type: object
             status:
               description: Status of the Issuer. This is set and managed automatically.
diff --git a/charts/cert-manager/templates/deployment.yaml b/charts/cert-manager/templates/deployment.yaml
index c4d267a..fa2af6c 100644
--- a/charts/cert-manager/templates/deployment.yaml
+++ b/charts/cert-manager/templates/deployment.yaml
@@ -86,7 +86,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-controller
-          image: "{{ template "image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+          image: "{{ template "cert-manager.image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
           {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -114,7 +114,7 @@
           - --leader-election-retry-period={{ .retryPeriod }}
           {{- end }}
           {{- end }}
-          - --acme-http01-solver-image={{ template "image" (tuple .Values.acmesolver.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}
+          - --acme-http01-solver-image={{ template "cert-manager.image" (tuple .Values.acmesolver.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}
           {{- with .Values.extraArgs }}
           {{- toYaml . | nindent 10 }}
           {{- end }}
@@ -132,6 +132,11 @@
           {{- if .Values.featureGates }}
           - --feature-gates={{ .Values.featureGates }}
           {{- end }}
+          {{- if .Values.global.commonLabels }}
+          {{- range $key, $value := .Values.global.commonLabels }}
+          - --acme-http01-solver-extra-labels={{ $key }}={{ $value }}
+          {{- end }}
+          {{- end }}
           {{- if .Values.maxConcurrentChallenges }}
           - --max-concurrent-challenges={{ .Values.maxConcurrentChallenges }}
           {{- end }}
@@ -147,6 +152,9 @@
           {{- if .Values.disableAutoApproval }}
           - --controllers=-certificaterequests-approver
           {{- end }}
+          {{- with .Values.acmesolver.runtimeClassName }}
+          - --acme-http01-solver-runtime-class-name={{ . | quote }}
+          {{- end }}
           ports:
           - containerPort: 9402
             name: http-metrics
@@ -213,6 +221,11 @@
       {{- if .Values.extraContainers }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
       {{- end }}
+      {{- if .Values.runtimeClassName }}
+      runtimeClassName: {{ .Values.runtimeClassName | quote }}
+      {{- else if .Values.global.runtimeClassName }}
+      runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+      {{- end }}
       {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
       {{- $nodeSelector = merge $nodeSelector (.Values.nodeSelector | default dict) }}
       {{- with $nodeSelector }}
diff --git a/charts/cert-manager/templates/podmonitor.yaml b/charts/cert-manager/templates/podmonitor.yaml
index 72d2dfe..f35f219 100644
--- a/charts/cert-manager/templates/podmonitor.yaml
+++ b/charts/cert-manager/templates/podmonitor.yaml
@@ -53,7 +53,7 @@
 {{- end }}
   podMetricsEndpoints:
     - port: http-metrics
-      path: {{ .Values.prometheus.podmonitor.path }}
+      path: /metrics
       interval: {{ .Values.prometheus.podmonitor.interval }}
       scrapeTimeout: {{ .Values.prometheus.podmonitor.scrapeTimeout }}
       honorLabels: {{ .Values.prometheus.podmonitor.honorLabels }}
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index e1a01b9..4910e72 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -45,50 +45,6 @@
 
 ---
 
-{{- if .Values.serviceAccount.create }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "cert-manager.fullname" . }}-tokenrequest
-  namespace: {{ include "cert-manager.namespace" . }}
-  labels:
-    app: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/name: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: "controller"
-    {{- include "labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
-    verbs: ["create"]
-
----
-
-# grant cert-manager permission to create tokens for the serviceaccount
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "cert-manager.fullname" . }}-tokenrequest
-  namespace: {{ include "cert-manager.namespace" . }}
-  labels:
-    app: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/name: {{ include "cert-manager.name" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/component: "controller"
-    {{- include "labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "cert-manager.fullname" . }}-tokenrequest
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "cert-manager.serviceAccountName" . }}
-    namespace: {{ include "cert-manager.namespace" . }}
-{{- end }}
-
----
-
 # Issuer controller role
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -515,15 +471,21 @@
     resources: ["certificates/status"]
     verbs: ["update"]
   {{- /*
-    Challenge and Order resources are not intended to be created or
-    modified directly by users.
+    Challenge and Order resources are not intended to be created by users
+    (GHSA-8rvj-mm4h-c258).
 
-    Challenges: "create" is excluded. "patch" and "update" are retained
-    because spec is immutable after creation (ValidateChallengeUpdate)
-    and because users need them to remove stuck finalizers
+    Challenges: "create" is excluded because a user-created Challenge with
+    attacker-controlled spec.solver can exfiltrate ClusterIssuer credentials
+    cross-namespace. "patch" and "update" are retained because spec is
+    immutable after creation (ValidateChallengeUpdate) so they cannot change
+    solver config, and because users need them to remove stuck finalizers
     (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
 
-    Orders: "create", "patch", and "update" are excluded.
+    Orders: "create", "patch", and "update" are excluded because a user
+    who can update an Order can change spec.issuerRef to reference a
+    different ClusterIssuer, then delete the Challenge; the Orders
+    controller recreates the Challenge with the attacker-chosen Issuer's
+    solver config, exfiltrating its credentials.
   */}}
   - apiGroups: ["acme.cert-manager.io"]
     resources: ["challenges"]
diff --git a/charts/cert-manager/templates/service.yaml b/charts/cert-manager/templates/service.yaml
index 360ec64..3dedc68 100644
--- a/charts/cert-manager/templates/service.yaml
+++ b/charts/cert-manager/templates/service.yaml
@@ -28,8 +28,7 @@
   ports:
   - protocol: TCP
     port: 9402
-    name: tcp-prometheus-servicemonitor
-    targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
+    name: http-metrics
   selector:
     app.kubernetes.io/name: {{ include "cert-manager.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/charts/cert-manager/templates/servicemonitor.yaml b/charts/cert-manager/templates/servicemonitor.yaml
index 76f358f..a33df0b 100644
--- a/charts/cert-manager/templates/servicemonitor.yaml
+++ b/charts/cert-manager/templates/servicemonitor.yaml
@@ -54,8 +54,8 @@
       - {{ include "cert-manager.namespace" . }}
 {{- end }}
   endpoints:
-  - targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
-    path: {{ .Values.prometheus.servicemonitor.path }}
+  - targetPort: http-metrics
+    path: /metrics
     {{- if .Values.prometheus.servicemonitor.interval }}
     interval: {{ .Values.prometheus.servicemonitor.interval }}
     {{- end }}
diff --git a/charts/cert-manager/templates/startupapicheck-job.yaml b/charts/cert-manager/templates/startupapicheck-job.yaml
index 7f1b0ff..0093472 100644
--- a/charts/cert-manager/templates/startupapicheck-job.yaml
+++ b/charts/cert-manager/templates/startupapicheck-job.yaml
@@ -16,6 +16,9 @@
   {{- end }}
 spec:
   backoffLimit: {{ .Values.startupapicheck.backoffLimit }}
+  {{- if hasKey .Values.startupapicheck "ttlSecondsAfterFinished" }}
+  ttlSecondsAfterFinished: {{ .Values.startupapicheck.ttlSecondsAfterFinished }}
+  {{- end }}
   template:
     metadata:
       labels:
@@ -54,7 +57,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-startupapicheck
-          image: "{{ template "image" (tuple .Values.startupapicheck.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+          image: "{{ template "cert-manager.image" (tuple .Values.startupapicheck.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
           args:
           - check
@@ -83,6 +86,11 @@
           volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+      {{- if .Values.startupapicheck.runtimeClassName }}
+      runtimeClassName: {{ .Values.startupapicheck.runtimeClassName | quote }}
+      {{- else if .Values.global.runtimeClassName }}
+      runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+      {{- end }}
       {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
       {{- $nodeSelector = merge $nodeSelector (.Values.startupapicheck.nodeSelector | default dict) }}
       {{- with $nodeSelector }}
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index 66d6ead..cb2425c 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -81,7 +81,7 @@
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-webhook
-          image: "{{ template "image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
+          image: "{{ template "cert-manager.image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
           imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
           args:
           {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
@@ -204,6 +204,11 @@
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.webhook.runtimeClassName }}
+      runtimeClassName: {{ .Values.webhook.runtimeClassName | quote }}
+      {{- else if .Values.global.runtimeClassName }}
+      runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+      {{- end }}
       {{- with .Values.webhook.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/cert-manager/values.schema.json b/charts/cert-manager/values.schema.json
index 24e8b39..1351b07 100644
--- a/charts/cert-manager/values.schema.json
+++ b/charts/cert-manager/values.schema.json
@@ -144,6 +144,9 @@
         "resources": {
           "$ref": "#/$defs/helm-values.resources"
         },
+        "runtimeClassName": {
+          "$ref": "#/$defs/helm-values.runtimeClassName"
+        },
         "securityContext": {
           "$ref": "#/$defs/helm-values.securityContext"
         },
@@ -191,6 +194,9 @@
       "properties": {
         "image": {
           "$ref": "#/$defs/helm-values.acmesolver.image"
+        },
+        "runtimeClassName": {
+          "$ref": "#/$defs/helm-values.acmesolver.runtimeClassName"
         }
       },
       "type": "object"
@@ -246,6 +252,11 @@
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
       "type": "string"
     },
+    "helm-values.acmesolver.runtimeClassName": {
+      "default": "",
+      "description": "A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).\n\nFor example:\nruntimeClassName: gvisor",
+      "type": "string"
+    },
     "helm-values.affinity": {
       "default": {},
       "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n  nodeAffinity:\n   requiredDuringSchedulingIgnoredDuringExecution:\n     nodeSelectorTerms:\n     - matchExpressions:\n       - key: foo.bar.com/role\n         operator: In\n         values:\n         - master",
@@ -321,6 +332,9 @@
         "resources": {
           "$ref": "#/$defs/helm-values.cainjector.resources"
         },
+        "runtimeClassName": {
+          "$ref": "#/$defs/helm-values.cainjector.runtimeClassName"
+        },
         "securityContext": {
           "$ref": "#/$defs/helm-values.cainjector.securityContext"
         },
@@ -585,6 +599,11 @@
       "description": "Resources to provide to the cert-manager cainjector pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
       "type": "object"
     },
+    "helm-values.cainjector.runtimeClassName": {
+      "default": "",
+      "description": "A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).\n\nFor example:\nruntimeClassName: gvisor",
+      "type": "string"
+    },
     "helm-values.cainjector.securityContext": {
       "default": {
         "runAsNonRoot": true,
@@ -683,7 +702,7 @@
     },
     "helm-values.config": {
       "default": {},
-      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  enableGatewayAPI: true\n  # Feature gates as of v1.20.0. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: true # BETA - default=true\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics\n  # Configure PEM size limits for certificate validation\n  # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)\n  pemSizeLimitsConfig:\n    maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)\n    maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)\n    maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)\n    maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)",
+      "description": "This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.\n\nIf `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.\n\nFor example:\nconfig:\n  apiVersion: controller.config.cert-manager.io/v1alpha1\n  kind: ControllerConfiguration\n  logging:\n    verbosity: 2\n    format: text\n  leaderElectionConfig:\n    namespace: kube-system\n  kubernetesAPIQPS: 9000\n  kubernetesAPIBurst: 9000\n  numberOfConcurrentWorkers: 200\n  gatewayAPI:\n    enable: true\n  # Feature gates as of v1.20.0. Listed with their default values.\n  # See https://cert-manager.io/docs/cli/controller/\n  featureGates:\n    AllAlpha: false # ALPHA - default=false\n    AllBeta: false # BETA - default=false\n    ACMEHTTP01IngressPathTypeExact: true # BETA - default=true\n    ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false\n    ExperimentalGatewayAPISupport: true # BETA - default=true\n    LiteralCertificateSubject: true # BETA - default=true\n    NameConstraints: true # BETA - default=true\n    OtherNames: true # BETA - default=true\n    SecretsFilteredCaching: true # BETA - default=true\n    ServerSideApply: false # ALPHA - default=false\n    StableCertificateRequestName: true # BETA - default=true\n    UseCertificateRequestBasicConstraints: false # ALPHA - default=false\n  # Configure the metrics server for TLS\n  # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls\n  metricsTLSConfig:\n    dynamic:\n      secretNamespace: \"cert-manager\"\n      secretName: \"cert-manager-metrics-ca\"\n      dnsNames:\n      - cert-manager-metrics\n  # Configure PEM size limits for certificate validation\n  # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)\n  pemSizeLimitsConfig:\n    maxCertificateSize: 36500     # Maximum size in bytes for individual certificates (default: 36500)\n    maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)\n    maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)\n    maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)\n  # Configure certificate request backoff durations\n  certificateRequestMinimumBackoffDuration: 1h\n  certificateRequestMaximumBackoffDuration: 32h",
       "type": "object"
     },
     "helm-values.containerSecurityContext": {
@@ -825,13 +844,16 @@
         },
         "revisionHistoryLimit": {
           "$ref": "#/$defs/helm-values.global.revisionHistoryLimit"
+        },
+        "runtimeClassName": {
+          "$ref": "#/$defs/helm-values.global.runtimeClassName"
         }
       },
       "type": "object"
     },
     "helm-values.global.commonLabels": {
       "default": {},
-      "description": "Labels to apply to all resources.\nPlease note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).\nFor example, secretTemplate in CertificateSpec\nFor more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).",
+      "description": "Labels to apply to all resources.\nThese labels are also applied to dynamically-created ACME HTTP01 solver resources\n(pods, services, ingresses, or Gateway API HTTPRoutes).\nThe following ACME identity label keys are reserved and will be silently ignored on dynamically-created resources: acme.cert-manager.io/http-domain, acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver. For per-Issuer-specific labels, use the HTTP01 ingress solver podTemplate and ingressTemplate fields for pod/ingress resources, or the gatewayHTTPRoute solver labels field for Gateway API HTTPRoute resources.",
       "type": "object"
     },
     "helm-values.global.hostUsers": {
@@ -939,6 +961,11 @@
       "description": "The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).",
       "type": "number"
     },
+    "helm-values.global.runtimeClassName": {
+      "default": "",
+      "description": "A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).\n\nFor example:\nruntimeClassName: gvisor",
+      "type": "string"
+    },
     "helm-values.hostAliases": {
       "default": [],
       "description": "Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks.",
@@ -1247,9 +1274,6 @@
         "namespace": {
           "$ref": "#/$defs/helm-values.prometheus.podmonitor.namespace"
         },
-        "path": {
-          "$ref": "#/$defs/helm-values.prometheus.podmonitor.path"
-        },
         "prometheusInstance": {
           "$ref": "#/$defs/helm-values.prometheus.podmonitor.prometheusInstance"
         },
@@ -1293,11 +1317,6 @@
       "description": "The namespace that the pod monitor should live in, defaults to the cert-manager namespace.",
       "type": "string"
     },
-    "helm-values.prometheus.podmonitor.path": {
-      "default": "/metrics",
-      "description": "The path to scrape for metrics.",
-      "type": "string"
-    },
     "helm-values.prometheus.podmonitor.prometheusInstance": {
       "default": "default",
       "description": "Specifies the `prometheus` label on the created PodMonitor. This is used when different Prometheus instances have label selectors matching different PodMonitors.",
@@ -1332,17 +1351,11 @@
         "namespace": {
           "$ref": "#/$defs/helm-values.prometheus.servicemonitor.namespace"
         },
-        "path": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.path"
-        },
         "prometheusInstance": {
           "$ref": "#/$defs/helm-values.prometheus.servicemonitor.prometheusInstance"
         },
         "scrapeTimeout": {
           "$ref": "#/$defs/helm-values.prometheus.servicemonitor.scrapeTimeout"
-        },
-        "targetPort": {
-          "$ref": "#/$defs/helm-values.prometheus.servicemonitor.targetPort"
         }
       },
       "type": "object"
@@ -1381,11 +1394,6 @@
       "description": "The namespace that the service monitor should live in, defaults to the cert-manager namespace.",
       "type": "string"
     },
-    "helm-values.prometheus.servicemonitor.path": {
-      "default": "/metrics",
-      "description": "The path to scrape for metrics.",
-      "type": "string"
-    },
     "helm-values.prometheus.servicemonitor.prometheusInstance": {
       "default": "default",
       "description": "Specifies the `prometheus` label on the created ServiceMonitor. This is used when different Prometheus instances have label selectors matching different ServiceMonitors.",
@@ -1396,10 +1404,6 @@
       "description": "The timeout before a metrics scrape fails.",
       "type": "string"
     },
-    "helm-values.prometheus.servicemonitor.targetPort": {
-      "default": "http-metrics",
-      "description": "The target port to set on the ServiceMonitor. This must match the port that the cert-manager controller is listening on for metrics."
-    },
     "helm-values.replicaCount": {
       "default": 1,
       "description": "The number of replicas of the cert-manager controller to run.\n\nThe default is 1, but in production set this to 2 or 3 to provide high availability.\n\nIf `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.\n\nNote that cert-manager uses leader election to ensure that there can only be a single instance active at a time.",
@@ -1410,6 +1414,11 @@
       "description": "Resources to provide to the cert-manager controller pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
       "type": "object"
     },
+    "helm-values.runtimeClassName": {
+      "default": "",
+      "description": "A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).\n\nFor example:\nruntimeClassName: gvisor",
+      "type": "string"
+    },
     "helm-values.securityContext": {
       "default": {
         "runAsNonRoot": true,
@@ -1528,6 +1537,9 @@
         "resources": {
           "$ref": "#/$defs/helm-values.startupapicheck.resources"
         },
+        "runtimeClassName": {
+          "$ref": "#/$defs/helm-values.startupapicheck.runtimeClassName"
+        },
         "securityContext": {
           "$ref": "#/$defs/helm-values.startupapicheck.securityContext"
         },
@@ -1540,6 +1552,9 @@
         "tolerations": {
           "$ref": "#/$defs/helm-values.startupapicheck.tolerations"
         },
+        "ttlSecondsAfterFinished": {
+          "$ref": "#/$defs/helm-values.startupapicheck.ttlSecondsAfterFinished"
+        },
         "volumeMounts": {
           "$ref": "#/$defs/helm-values.startupapicheck.volumeMounts"
         },
@@ -1696,9 +1711,14 @@
     },
     "helm-values.startupapicheck.resources": {
       "default": {},
-      "description": "Resources to provide to the cert-manager controller pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
+      "description": "Resources to provide to the cert-manager startupapicheck pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
       "type": "object"
     },
+    "helm-values.startupapicheck.runtimeClassName": {
+      "default": "",
+      "description": "A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).\n\nFor example:\nruntimeClassName: gvisor",
+      "type": "string"
+    },
     "helm-values.startupapicheck.securityContext": {
       "default": {
         "runAsNonRoot": true,
@@ -1768,6 +1788,9 @@
       "items": {},
       "type": "array"
     },
+    "helm-values.startupapicheck.ttlSecondsAfterFinished": {
+      "description": "Limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, once the Job finishes, it will be automatically cleaned up after ttlSecondsAfterFinished seconds. This is disabled by default (field is not set) to preserve backward compatibility and avoid issues with GitOps tools (e.g. Argo CD) that may attempt to reconcile or recreate Jobs after they are automatically deleted. For more information, see [Automatic Cleanup for Finished Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/)."
+    },
     "helm-values.startupapicheck.volumeMounts": {
       "default": [],
       "description": "Additional volume mounts to add to the cert-manager controller container.",
@@ -1890,6 +1913,9 @@
         "resources": {
           "$ref": "#/$defs/helm-values.webhook.resources"
         },
+        "runtimeClassName": {
+          "$ref": "#/$defs/helm-values.webhook.runtimeClassName"
+        },
         "securePort": {
           "$ref": "#/$defs/helm-values.webhook.securePort"
         },
@@ -2245,6 +2271,11 @@
       "description": "Resources to provide to the cert-manager webhook pod.\n\nFor example:\nrequests:\n  cpu: 10m\n  memory: 32Mi\nFor more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).",
       "type": "object"
     },
+    "helm-values.webhook.runtimeClassName": {
+      "default": "",
+      "description": "A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).\n\nFor example:\nruntimeClassName: gvisor",
+      "type": "string"
+    },
     "helm-values.webhook.securePort": {
       "default": 10250,
       "description": "The port that the webhook listens on for requests. In GKE private clusters, by default Kubernetes apiservers are allowed to talk to the cluster nodes only on 443 and 10250. Configuring securePort: 10250, therefore will work out-of-the-box without needing to add firewall rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.",
diff --git a/charts/cert-manager/values.yaml b/charts/cert-manager/values.yaml
index 4bd3ebf..be1388d 100644
--- a/charts/cert-manager/values.yaml
+++ b/charts/cert-manager/values.yaml
@@ -23,12 +23,14 @@
   nodeSelector: {}
 
   # Labels to apply to all resources.
-  # Please note that this does not add labels to the resources created dynamically by the controllers.
-  # For these resources, you have to add the labels in the template in the cert-manager custom resource:
-  # For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
-  # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).
-  # For example, secretTemplate in CertificateSpec
-  # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
+  # These labels are also applied to dynamically-created ACME HTTP01 solver resources
+  # (pods, services, ingresses, or Gateway API HTTPRoutes).
+  # The following ACME identity label keys are reserved and will be
+  # silently ignored on dynamically-created resources: acme.cert-manager.io/http-domain,
+  # acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver.
+  # For per-Issuer-specific labels, use the HTTP01 ingress solver podTemplate and
+  # ingressTemplate fields for pod/ingress resources, or the gatewayHTTPRoute
+  # solver labels field for Gateway API HTTPRoute resources.
   commonLabels: {}
 
   # The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10).
@@ -90,6 +92,13 @@
     # +docs:property
     # retryPeriod: 15s
 
+  # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+  #
+  # For example:
+  #   runtimeClassName: gvisor
+  # +docs:property
+  runtimeClassName: ""
+
 # This option is equivalent to setting crds.enabled=true and crds.keep=true.
 # Deprecated: use crds.enabled and crds.keep instead.
 installCRDs: false
@@ -286,7 +295,8 @@
 #    kubernetesAPIQPS: 9000
 #    kubernetesAPIBurst: 9000
 #    numberOfConcurrentWorkers: 200
-#    enableGatewayAPI: true
+#    gatewayAPI:
+#      enable: true
 #    # Feature gates as of v1.20.0. Listed with their default values.
 #    # See https://cert-manager.io/docs/cli/controller/
 #    featureGates:
@@ -317,6 +327,9 @@
 #      maxPrivateKeySize: 13000      # Maximum size in bytes for private keys (default: 13000)
 #      maxChainLength: 95000         # Maximum size in bytes for certificate chains (default: 95000)
 #      maxBundleSize: 330000         # Maximum size in bytes for certificate bundles (default: 330000)
+#    # Configure certificate request backoff durations
+#    certificateRequestMinimumBackoffDuration: 1h
+#    certificateRequestMaximumBackoffDuration: 32h
 config: {}
 
 # Setting Nameservers for DNS01 Self Check.
@@ -580,6 +593,13 @@
 #            - master
 affinity: {}
 
+# A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+#
+# For example:
+#   runtimeClassName: gvisor
+# +docs:property
+runtimeClassName: ""
+
 # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
 #
 # For example:
@@ -651,14 +671,6 @@
     # different ServiceMonitors.
     prometheusInstance: default
 
-    # The target port to set on the ServiceMonitor. This must match the port that the
-    # cert-manager controller is listening on for metrics.
-    # +docs:type=string,integer
-    targetPort: http-metrics
-
-    # The path to scrape for metrics.
-    path: /metrics
-
     # The interval to scrape metrics.
     interval: 60s
 
@@ -703,9 +715,6 @@
     # different PodMonitors.
     prometheusInstance: default
 
-    # The path to scrape for metrics.
-    path: /metrics
-
     # The interval to scrape metrics.
     interval: 60s
 
@@ -974,6 +983,13 @@
   #            - master
   affinity: {}
 
+  # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+  #
+  # For example:
+  #   runtimeClassName: gvisor
+  # +docs:property
+  runtimeClassName: ""
+
   # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
   #
   # For example:
@@ -1359,6 +1375,13 @@
   #            - master
   affinity: {}
 
+  # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+  #
+  # For example:
+  #   runtimeClassName: gvisor
+  # +docs:property
+  runtimeClassName: ""
+
   # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
   #
   # For example:
@@ -1492,6 +1515,13 @@
     # Kubernetes imagePullPolicy on Deployment.
     pullPolicy: IfNotPresent
 
+  # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+  #
+  # For example:
+  #   runtimeClassName: gvisor
+  # +docs:property
+  runtimeClassName: ""
+
 # +docs:section=Startup API Check
 # This startupapicheck is a Helm post-install hook that waits for the webhook
 # endpoints to become available.
@@ -1529,6 +1559,17 @@
   # Job backoffLimit
   backoffLimit: 4
 
+  # Limits the lifetime of a Job that has finished execution (either Complete
+  # or Failed). If this field is set, once the Job finishes, it will be
+  # automatically cleaned up after ttlSecondsAfterFinished seconds. This is
+  # disabled by default (field is not set) to preserve backward compatibility
+  # and avoid issues with GitOps tools (e.g. Argo CD) that may attempt to
+  # reconcile or recreate Jobs after they are automatically deleted.
+  # For more information, see [Automatic Cleanup for Finished Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/).
+  # +docs:property
+  # +docs:type=integer
+  # ttlSecondsAfterFinished:
+
   # Optional additional annotations to add to the startupapicheck Job.
   # +docs:property
   jobAnnotations:
@@ -1557,7 +1598,7 @@
   #    value: 'some value'
   extraEnv: []
 
-  # Resources to provide to the cert-manager controller pod.
+  # Resources to provide to the cert-manager startupapicheck pod.
   #
   # For example:
   #  requests:
@@ -1591,6 +1632,13 @@
   #            - master
   affinity: {}
 
+  # A Kubernetes Runtime Class to apply to ACME HTTP01 solver pods, if required. For more information, see [Runtime Class](https://kubernetes.io/docs/concepts/containers/).
+  #
+  # For example:
+  #   runtimeClassName: gvisor
+  # +docs:property
+  runtimeClassName: ""
+
   # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
   #
   # For example: