diff --git a/templates/cluster-network-07-cilium-ciliumconfig.yaml b/templates/cluster-network-07-cilium-ciliumconfig.yaml
index 42f57bc..783cb38 100644
--- a/templates/cluster-network-07-cilium-ciliumconfig.yaml
+++ b/templates/cluster-network-07-cilium-ciliumconfig.yaml
@@ -45,3 +45,12 @@ spec:
       enabled: true
     ui:
       enabled: true
+    tls:
+      auto:
+        # The default value (`helm`) runs into a silly
+        # upgrade-to-not-really-change-anything loop:
+        method: certmanager
+        certManagerIssuerRef:
+          group: cert-manager.io
+          kind: ClusterIssuer
+          name: ca-issuer