diff --git a/infrastructure/cert-manager/cloudflare-issuer.yaml b/infrastructure/cert-manager/cloudflare-issuer.yaml
new file mode 100644
index 0000000..184a8d8
--- /dev/null
+++ b/infrastructure/cert-manager/cloudflare-issuer.yaml
@@ -0,0 +1,27 @@
+# ClusterIssuer voor Let's Encrypt via Cloudflare DNS-01 (voor labzand.com).
+# Vereist een secret in namespace cert-manager (ClusterIssuer mag alleen
+# secrets uit de cert-manager namespace lezen), bijv. via sealed-secrets:
+#
+#   apiVersion: v1
+#   kind: Secret
+#   metadata:
+#     name: cloudflare-api-token
+#     namespace: cert-manager
+#   stringData:
+#     api-token: <CLOUDFLARE_API_TOKEN>
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cloudflare-dns
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: wulsspaans@gmail.com
+    privateKeySecretRef:
+      name: cloudflare-dns-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token
diff --git a/infrastructure/cert-manager/cloudflare-token-sealed.yaml b/infrastructure/cert-manager/cloudflare-token-sealed.yaml
new file mode 100644
index 0000000..4272ad6
--- /dev/null
+++ b/infrastructure/cert-manager/cloudflare-token-sealed.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgA+SL4T6mIhlShhHf7wEJhXWGCo2lmtFhNlWJotBlIvaZttsknSaaAzmEwolk+Kk5i8JA6yTSkgi2dux0EVkl3waLgnEFvmcHMSgKbJDiosgVOgIjPOriy5rrgeqZaWLplmkqVEI20NYe/6rW9ByVBf38RAaQsx2msxO7u3dKXC5fJXlDwCosdNKo4eik7OFJrb+X9nBc3gpF3DgBQeWK/QtdC9di3fVpYlRhxC2X0o73rDaqauUvERG1fl78DtuteRiIFpRESstP9cyjgdDRNH5WvSX+Wc+TgUOPk/LmnO0gnfTwhk1GK//2NdO065tQeAkM9aaajOLgyC5rTvo7cK+4FcG92wb1aPU0Vr93V4rj8lgBFOBWmg/64r25rNSNEA/eOpyDw4Vzb3c7PyqRUlMQ1xNoMNXfBzBHlS5wjn5nJm8A9TwDPEKHbYVLzvUkMpaXYUJUOVqBL5czOIcr2UdaOEK6sIFtLVe/dGejT+ZlgM4V9BfQGXJYS1NdWtHX2iXKWhAWU4EyodS5MaQMjggW/VN8CsRvnLZo3m+YLCZmH7FVQisjovhhhon+IFyzzggWtDy3NiKGx1pfVN1x/bvFJ/MkaS5kbxFwvvqh3A1cJSnsAAVV4qJ12MwSawh++QzNG7b/plOgLtDnzTrofjcsgf6iBuGBPI6xYPlWKxp4kPqGjpi/rAqMD/0ZzpQz2fu92gEBBjsKNGYbIf1k+IFy8DoGbu8Y172OLGa1JrLZcgmm8bMuYEiZqQrLb84lqHOg4rkuw=
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager