diff --git a/services/adguard/app.yaml b/services/adguard/app.yaml
index 233426e..f66c456 100644
--- a/services/adguard/app.yaml
+++ b/services/adguard/app.yaml
@@ -87,7 +87,7 @@ metadata:
   namespace: adguard
 spec:
   rules:
-  - host: adguard-cluster.zb-kw.duckdns.org
+  - host: adguard.labzand.com
     http:
       paths:
       - path: /
@@ -95,5 +95,5 @@ spec:
         backend:
           service: {name: adguard-service, port: {number: 80}}
   tls:
-  - hosts: [adguard-cluster.zb-kw.duckdns.org]
-    secretName: zb-kw-wildcard-tls
\ No newline at end of file
+  - hosts: [adguard.labzand.com]
+    secretName: labzand-wildcard-tls
diff --git a/services/adguard/cert.yaml b/services/adguard/cert.yaml
index d2a9652..5b1ed23 100644
--- a/services/adguard/cert.yaml
+++ b/services/adguard/cert.yaml
@@ -1,10 +1,14 @@
 # services/<naam>/cert.yaml
+# Wildcard-certificaat voor *.labzand.com via Cloudflare DNS-01.
+# Vervangt de oude duckdns-cert (zb-kw-wildcard-tls).
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: zb-kw-wildcard
+  name: labzand-wildcard
   namespace: adguard
 spec:
-  secretName: zb-kw-wildcard-tls
-  dnsNames: ["adguard-cluster.zb-kw.duckdns.org"]
-  issuerRef: {name: duckdns, kind: ClusterIssuer}
\ No newline at end of file
+  secretName: labzand-wildcard-tls
+  dnsNames: ["*.labzand.com"]
+  issuerRef:
+    name: cloudflare-dns
+    kind: ClusterIssuer