diff --git a/.holo/sources/civic-cloud.toml b/.holo/sources/civic-cloud.toml
index d0064cc..c8ffb0e 100644
--- a/.holo/sources/civic-cloud.toml
+++ b/.holo/sources/civic-cloud.toml
@@ -1,3 +1,3 @@
 [holosource]
 url = "https://github.com/civic-cloud/cluster-template"
-ref = "refs/tags/v1.7.8"
+ref = "refs/tags/v1.8.0"
diff --git a/cert-manager/helm-values.yaml b/cert-manager/helm-values.yaml
new file mode 100644
index 0000000..7a3e45f
--- /dev/null
+++ b/cert-manager/helm-values.yaml
@@ -0,0 +1,12 @@
+# Overrides the stale helm-values.yaml pulled from cert-manager's source.
+# Upstream cert-manager keeps `ingressShim.resources` and `webhook.enabled`
+# in deploy/manifests/helm-values.yaml, but the chart schema in v1.20+ no
+# longer accepts those keys — they fail validation.
+# This file mirrors the still-valid bits.
+
+fullnameOverride: cert-manager
+
+resources:
+  requests:
+    cpu: 10m
+    memory: 32Mi