diff --git a/.github/ct.yaml b/.github/ct.yaml
index 2da3947..afda5c6 100644
--- a/.github/ct.yaml
+++ b/.github/ct.yaml
@@ -4,7 +4,7 @@ check-version-increment: false
 debug: false
 remote: origin
 target-branch: main
-upgrade: true
+upgrade: false
 validate-chart-schema: true
 validate-maintainers: false
 validate-yaml: true
diff --git a/charts/dwpk/Chart.yaml b/charts/dwpk/Chart.yaml
index 0870e54..a904194 100644
--- a/charts/dwpk/Chart.yaml
+++ b/charts/dwpk/Chart.yaml
@@ -10,7 +10,7 @@ sources:
   - https://github.com/devops-ia/helm-dwpk
   - https://github.com/devops-ia/dwpk
 version: 0.1.0
-appVersion: "1.0.0"
+appVersion: 1.0.2
 home: https://github.com/devops-ia/dwpk
 keywords:
   - kubernetes
diff --git a/charts/dwpk/README.md b/charts/dwpk/README.md
index 42fec99..fa9a7ee 100644
--- a/charts/dwpk/README.md
+++ b/charts/dwpk/README.md
@@ -1,6 +1,6 @@
 # dwpk
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)  ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)  ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![AppVersion: 1.0.2](https://img.shields.io/badge/AppVersion-1.0.2-informational?style=flat-square)
 
 Development Workspace Platform for Kubernetes: a Go operator, an SSH gateway, and a marketplace web UI, deployed together by this chart.
 
diff --git a/charts/dwpk/ci/ct-values.yaml b/charts/dwpk/ci/ct-values.yaml
index 85d0008..ba44685 100644
--- a/charts/dwpk/ci/ct-values.yaml
+++ b/charts/dwpk/ci/ct-values.yaml
@@ -18,3 +18,9 @@ prometheus:
 # previous release, so the next install fails on ownership metadata.
 crd:
   keep: false
+
+# CI only: leader election needs a Lease in a hardcoded namespace, and ct installs
+# into random ones. A single replica does not need it.
+manager:
+  replicas: 1
+  args: []
diff --git a/charts/dwpk/templates/cert-manager/serving-cert.yaml b/charts/dwpk/templates/cert-manager/serving-cert.yaml
index 49e20ed..fd85553 100644
--- a/charts/dwpk/templates/cert-manager/serving-cert.yaml
+++ b/charts/dwpk/templates/cert-manager/serving-cert.yaml
@@ -17,4 +17,27 @@ spec:
     kind: Issuer
     name: {{ include "dwpk.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
   secretName: webhook-server-cert
+{{- else }}
+{{- /*
+  The manager always starts its webhook server and exits without a serving
+  cert, so without cert-manager the chart ships a self-signed one.
+  ponytail: regenerated on every upgrade and no caBundle is injected into the
+  webhook configurations; use cert-manager when webhook.enabled is true.
+*/}}
+{{- $svc := include "dwpk.resourceName" (dict "suffix" "webhook-service" "context" $) }}
+{{- $cert := genSelfSignedCert (printf "%s.%s.svc" $svc .Release.Namespace) nil (list (printf "%s.%s.svc" $svc .Release.Namespace) (printf "%s.%s.svc.cluster.local" $svc .Release.Namespace)) 3650 }}
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/tls
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "dwpk.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  name: webhook-server-cert
+  namespace: {{ .Release.Namespace }}
+data:
+  tls.crt: {{ $cert.Cert | b64enc }}
+  tls.key: {{ $cert.Key | b64enc }}
 {{- end }}
diff --git a/charts/dwpk/templates/manager/manager.yaml b/charts/dwpk/templates/manager/manager.yaml
index e682207..842d751 100644
--- a/charts/dwpk/templates/manager/manager.yaml
+++ b/charts/dwpk/templates/manager/manager.yaml
@@ -118,9 +118,7 @@ spec:
         {{- range .Values.manager.args }}
         - {{ . }}
         {{- end }}
-        {{- if .Values.certManager.enabled }}
         - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
-        {{- end }}
         command:
         {{- with .Values.manager.command }}
         {{- toYaml . | nindent 8 }}
@@ -181,11 +179,9 @@ spec:
           {{- if .Values.manager.extraVolumeMounts }}
           {{- toYaml .Values.manager.extraVolumeMounts | nindent 10 }}
           {{- end }}
-          {{- if .Values.certManager.enabled }}
           - mountPath: /tmp/k8s-webhook-server/serving-certs
             name: webhook-certs
             readOnly: true
-          {{- end }}
       securityContext:
         {{- if .Values.manager.podSecurityContext }}
         {{- toYaml .Values.manager.podSecurityContext | nindent 8 }}
@@ -200,9 +196,7 @@ spec:
         {{- if .Values.manager.extraVolumes }}
         {{- toYaml .Values.manager.extraVolumes | nindent 8 }}
         {{- end }}
-        {{- if .Values.certManager.enabled }}
         - name: webhook-certs
           secret:
             secretName: webhook-server-cert
-        {{- end }}
 {{- end }}