diff --git a/platform/cert-manager/helmrelease.yaml b/platform/cert-manager/helmrelease.yaml
index aa48ba5..72f0a20 100644
--- a/platform/cert-manager/helmrelease.yaml
+++ b/platform/cert-manager/helmrelease.yaml
@@ -24,5 +24,10 @@ spec:
   values:
     crds:
       enabled: true      # install CRDs with the chart
-    # TODO(WS-SEC, Phase 2): DNS-01 recursive nameserver config if split-horizon DNS interferes
-    #   with propagation checks (docs/09 split-horizon note).
+    # DNS-01 self-check via PUBLIC resolvers. The k3s-dev cluster is NAT'd and its DNS can't resolve
+    # the public _acme-challenge TXT that cert-manager creates in Cloudflare (VERIFIED: the record IS
+    # publicly resolvable via 1.1.1.1/8.8.8.8, but the in-cluster self-check timed out — "not yet
+    # propagated"). Point the propagation check straight at public resolvers so it never relies on
+    # cluster/split-horizon DNS (docs/09 split-horizon note; realises the TODO that was here).
+    dns01RecursiveNameservers: "1.1.1.1:53,8.8.8.8:53"
+    dns01RecursiveNameserversOnly: true