diff --git a/clusters/dev/kustomization.yaml b/clusters/dev/kustomization.yaml
index 53abd1c..09e4dbe 100644
--- a/clusters/dev/kustomization.yaml
+++ b/clusters/dev/kustomization.yaml
@@ -58,10 +58,12 @@ patches:
       - op: replace
         path: /data/CLUSTER_ENV
         value: "dev"
-      # DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
+      # DNS-01 via LE PRODUCTION: in-cluster OIDC clients (oauth2-proxy, Grafana) must trust the
+      # wildcard cert for SSO to work; the staging root isn't in any trust store. Prod issuer is
+      # registered + Ready; one wildcard cert is well within LE rate limits — ADR-0006, R-TLS-01/03.
       - op: replace
         path: /data/ACME_CLUSTER_ISSUER
-        value: "letsencrypt-staging"
+        value: "letsencrypt-prod"
       # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
       - op: replace
         path: /data/LONGHORN_DEFAULT_REPLICA_COUNT