diff --git a/dataplane-template/certificate.yaml b/dataplane-template/certificate.yaml
deleted file mode 100644
index 3eb1fff..0000000
--- a/dataplane-template/certificate.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-# Not a self-signed cert hand-copied into a Secret like
-# ~/dev/kong/kube/gateway/apigw/secret.yaml does — issuer is per-domain/env
-# config (e.g. sttlab-local-ca ClusterIssuer for local, a real ACME issuer
-# for prod), not hardcoded here.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ${NAME}
-  namespace: ${NAMESPACE}
-spec:
-  secretName: ${NAME}-tls
-  dnsNames:
-    - ${HOSTNAME}
-  issuerRef:
-    kind: ${TLS_ISSUER_KIND}
-    name: ${TLS_ISSUER_NAME}
diff --git a/dataplane-template/externalsecret-tls.yaml b/dataplane-template/externalsecret-tls.yaml
new file mode 100644
index 0000000..a4f408c
--- /dev/null
+++ b/dataplane-template/externalsecret-tls.yaml
@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ${NAME}-tls
+  namespace: ${NAMESPACE}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: ${NAME}-tls
+    template:
+      type: kubernetes.io/tls
+  data:
+    - secretKey: tls.crt
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.crt
+    - secretKey: tls.key
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.key
diff --git a/dataplane-template/kustomization.yaml b/dataplane-template/kustomization.yaml
index bdf5bf8..c9f028c 100644
--- a/dataplane-template/kustomization.yaml
+++ b/dataplane-template/kustomization.yaml
@@ -4,4 +4,4 @@ resources:
   - konnectapiauthconfiguration.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
-  - certificate.yaml
+  - externalsecret-tls.yaml
diff --git a/kong-platform/dataplane-template-defaults.yaml b/kong-platform/dataplane-template-defaults.yaml
index 0800421..7a61cab 100644
--- a/kong-platform/dataplane-template-defaults.yaml
+++ b/kong-platform/dataplane-template-defaults.yaml
@@ -14,7 +14,6 @@ data:
   KONNECT_SERVER_URL: eu.api.konghq.com
   GATEWAY_IMAGE: kong/kong-gateway:3.15
   REPLICAS: "1"
-  TLS_ISSUER_KIND: ClusterIssuer
   OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way
   CORS_ORIGINS: https://*.sttlab.local
   RATE_LIMIT_MINUTE: "300"