diff --git a/apps/cert-manager/README.md b/apps/cert-manager/README.md
index 23c6bb9..c148543 100644
--- a/apps/cert-manager/README.md
+++ b/apps/cert-manager/README.md
@@ -28,8 +28,9 @@ writer have been retired and archived; its CI kubeconfig secret and deployer
 RBAC are removed. Argo CD now owns the complete declarative cert-manager
 configuration with automated sync, self-heal, and pruning. The
 `watschn.studio` domain is no longer controlled, so its DNS-01 renewal cannot
-complete. Its current Certificate remains Ready with the existing TLS Secret,
-but the renewal challenge keeps this Application's health at Progressing. We
-are retaining that Certificate and Secret for now rather than risking an
-unreviewed TLS-resource deletion; remove them only if the service/domain owner
-confirms they are no longer needed.
+complete. Its current Certificate remains Ready and its existing TLS Secret is
+still referenced by the site Ingress. Keep both resources to avoid disrupting
+the current deployment, but ignore this Certificate's Argo health: the stale
+renewal challenge must not block unrelated cert-manager upgrades or parent
+app-of-apps reconciliation. Remove the Certificate and Secret only after the
+site/domain owner confirms they are no longer needed.
diff --git a/apps/cert-manager/resources/certificates.yaml b/apps/cert-manager/resources/certificates.yaml
index 97b8eb2..b73c692 100644
--- a/apps/cert-manager/resources/certificates.yaml
+++ b/apps/cert-manager/resources/certificates.yaml
@@ -23,6 +23,9 @@ metadata:
   namespace: default
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+    # Preserve the last valid certificate, but don't let its non-renewable
+    # challenge block cert-manager or app-of-apps reconciliation.
+    argocd.argoproj.io/ignore-healthcheck: "true"
 spec:
   secretName: watschn-studio-tls
   issuerRef: