diff --git a/ingress-default.yaml b/ingress-default.yaml
--- a/ingress-default.yaml
+++ b/ingress-default.yaml
@@ -3,7 +3,7 @@ kind: Ingress
 metadata:
   name: default
   annotations:
-    cert-manager.io/issuer: letsencrypt-prod
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     ingress.pomerium.io/allow_public_unauthenticated_access: "true"
     ingress.pomerium.io/pass_identity_headers: "true"
     ingress.pomerium.io/preserve_host_header: "true"