diff --git a/apps/cert-manager/README.md b/apps/cert-manager/README.md
index d790ea5..23c6bb9 100644
--- a/apps/cert-manager/README.md
+++ b/apps/cert-manager/README.md
@@ -22,3 +22,14 @@ For a local recovery install, read the chart version and values from
 [`bootstrap/cert-manager.yaml`](../../bootstrap/cert-manager.yaml) and
 [`values.yaml`](values.yaml). Normal upgrades are made by changing that
 Application's chart `targetRevision` and allowing Argo CD to reconcile it.
+
+The former `cert-manager-deployment` repository and its direct Kubernetes CI
+writer have been retired and archived; its CI kubeconfig secret and deployer
+RBAC are removed. Argo CD now owns the complete declarative cert-manager
+configuration with automated sync, self-heal, and pruning. The
+`watschn.studio` domain is no longer controlled, so its DNS-01 renewal cannot
+complete. Its current Certificate remains Ready with the existing TLS Secret,
+but the renewal challenge keeps this Application's health at Progressing. We
+are retaining that Certificate and Secret for now rather than risking an
+unreviewed TLS-resource deletion; remove them only if the service/domain owner
+confirms they are no longer needed.
diff --git a/bootstrap/cert-manager.yaml b/bootstrap/cert-manager.yaml
index 8ceda38..872fe9e 100644
--- a/bootstrap/cert-manager.yaml
+++ b/bootstrap/cert-manager.yaml
@@ -25,7 +25,7 @@ spec:
   syncPolicy:
     automated:
       enabled: true
-      prune: false
+      prune: true
       selfHeal: true
     syncOptions:
     - CreateNamespace=true