diff --git a/infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml b/infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml
deleted file mode 100644
index 22eab42..0000000
--- a/infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-issuer-istio
-spec:
-  acme:
-    email: "pavel@sarex.io"
-    privateKeySecretRef:
-      name: letsencrypt-secret-key
-    server: "https://acme-v02.api.letsencrypt.org/directory"
-    solvers:
-      - http01:
-          ingress:
-            class: istio
-            podTemplate:
-              spec:
-                imagePullSecrets:
-                  - name: istio-registry-secret
diff --git a/infrastructure/cert-manager/vk-infra/kustomization.yaml b/infrastructure/cert-manager/vk-infra/kustomization.yaml
index 3344871..0d4089a 100644
--- a/infrastructure/cert-manager/vk-infra/kustomization.yaml
+++ b/infrastructure/cert-manager/vk-infra/kustomization.yaml
@@ -10,7 +10,6 @@ patches:
       kind: HelmRelease
       name: cert-manager
       namespace: cert-manager
-  - path: ./clusterissuer-letsencrypt-istio.yaml
   - target:
       group: cert-manager.io
       version: v1
@@ -22,3 +21,14 @@ patches:
       kind: ClusterIssuer
       metadata:
         name: letsencrypt-issuer
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer-istio
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer-istio
diff --git a/infrastructure/istio-config/vk-infra/istio-config.yaml b/infrastructure/istio-config/vk-infra/istio-config.yaml
index 9f2daae..fa0fe1b 100644
--- a/infrastructure/istio-config/vk-infra/istio-config.yaml
+++ b/infrastructure/istio-config/vk-infra/istio-config.yaml
@@ -19,6 +19,22 @@ spec:
     environments:
       vk-infra:
         certManager:
+          clusterIssuers:
+            letsencrypt-issuer-istio:
+              spec:
+                acme:
+                  email: pavel@sarex.io
+                  privateKeySecretRef:
+                    name: letsencrypt-secret-key
+                  server: https://acme-v02.api.letsencrypt.org/directory
+                  solvers:
+                    - http01:
+                        ingress:
+                          class: istio
+                          podTemplate:
+                            spec:
+                              imagePullSecrets:
+                                - name: istio-registry-secret
           certificates:
             idp-tls:
               dnsNames: