diff --git a/apps/mumble/resources/certificate.yaml b/apps/mumble/resources/certificate.yaml
new file mode 100644
index 0000000..f2b83e5
--- /dev/null
+++ b/apps/mumble/resources/certificate.yaml
@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: brunner-ninja
+  namespace: mumble
+spec:
+  secretName: brunner-ninja-tls
+  issuerRef:
+    name: letsencrypt-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - brunner.ninja
+    - '*.brunner.ninja'
+  privateKey:
+    rotationPolicy: Always
diff --git a/apps/mumble/resources/kustomization.yaml b/apps/mumble/resources/kustomization.yaml
new file mode 100644
index 0000000..1615af2
--- /dev/null
+++ b/apps/mumble/resources/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificate.yaml
diff --git a/apps/mumble/values.yaml b/apps/mumble/values.yaml
index 2a29bf5..4e9881c 100644
--- a/apps/mumble/values.yaml
+++ b/apps/mumble/values.yaml
@@ -1,9 +1,9 @@
-# Dedicated PostgreSQL contains the verified final pg_dump from the former
-# shared database. The old database is retained as rollback data.
 mumble:
-  enabled: true
+  enabled: false
 database:
-  host: mumble-postgresql.default.svc.cluster.local
+  host: mumble-postgresql-rw.mumble.svc.cluster.local
+  bootstrap:
+    enabled: false
 secrets:
   mumble: mumble-secrets
   postgresql: postgresql
@@ -29,19 +29,4 @@ service:
           - 10.12.4.170
           - 192.168.0.2
 postgresql:
-  enabled: true
-  auth:
-    username: mumble
-    database: mumble
-    existingSecret: mumble-postgres
-    secretKeys:
-      adminPasswordKey: postgres-password
-      userPasswordKey: database-password
-  primary:
-    persistence:
-      storageClass: rook-ceph-block-ec
-      size: 8Gi
-    persistentVolumeClaimRetentionPolicy:
-      enabled: true
-      whenDeleted: Retain
-      whenScaled: Retain
+  enabled: false
diff --git a/bootstrap/mumble.yaml b/bootstrap/mumble.yaml
index 6c633e1..20398ff 100644
--- a/bootstrap/mumble.yaml
+++ b/bootstrap/mumble.yaml
@@ -15,11 +15,16 @@ spec:
     - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
       targetRevision: main
       ref: values
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      path: apps/mumble/resources
   destination:
     server: https://kubernetes.default.svc
-    namespace: default
+    namespace: mumble
   syncPolicy:
     automated:
       enabled: true
       prune: false
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/bootstrap/project.yaml b/bootstrap/project.yaml
index a66c735..05b2d73 100644
--- a/bootstrap/project.yaml
+++ b/bootstrap/project.yaml
@@ -17,6 +17,8 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: wiki-js
     server: https://kubernetes.default.svc
+  - namespace: mumble
+    server: https://kubernetes.default.svc
   namespaceResourceWhitelist:
   - group: ""
     kind: ConfigMap
@@ -46,3 +48,7 @@ spec:
     kind: Middleware
   - group: bitnami.com
     kind: SealedSecret
+  - group: postgresql.cnpg.io
+    kind: Cluster
+  - group: cert-manager.io
+    kind: Certificate