diff --git a/clusters/homelab/README.md b/clusters/homelab/README.md
index 4add4e3..9fd7b3f 100644
--- a/clusters/homelab/README.md
+++ b/clusters/homelab/README.md
@@ -43,7 +43,8 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations
 - `http-echo` 的专用测试 ConfigMap 已在 `prune: true` 生效后重新纳管，并由下一
   revision 自动删除；
 - `http-echo` 保持 `prune: true`，root 保持 `prune: false`；
-- `gitea-actions` 与 `gitea` 已由 Flux HelmRelease 接管，Gitea 已升级到 `1.27.3`；
-- 当前接管对象是 External Secrets Operator：先固定现有 chart `2.8.0` 并以
-  `suspend: true` 登记，确认零变化后再独立激活；
+- `gitea-actions`、`gitea` 与 External Secrets 已由 Flux HelmRelease 接管，Gitea 已升级到 `1.27.3`；
+- cert-manager 已进入分阶段接管：固定现有 `v1.21.0`，HelmRelease 暂停等待零变更验证；
+- External Secrets Operator 已固定 chart `2.8.0` 并完成分阶段接管；
+- 当前接管对象是 cert-manager，激活必须继续使用独立 PR；
 - root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。
diff --git a/clusters/homelab/apps/cert-manager.yaml b/clusters/homelab/apps/cert-manager.yaml
new file mode 100644
index 0000000..fb3fa69
--- /dev/null
+++ b/clusters/homelab/apps/cert-manager.yaml
@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./platform/cert-manager
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 3m
+  wait: false
diff --git a/clusters/homelab/kustomization.yaml b/clusters/homelab/kustomization.yaml
index 7ea1f06..5574ebf 100644
--- a/clusters/homelab/kustomization.yaml
+++ b/clusters/homelab/kustomization.yaml
@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - flux-system
   - namespaces/gitops-canary.yaml
+  - apps/cert-manager.yaml
   - apps/external-secrets.yaml
   - apps/gitea.yaml
   - apps/gitea-actions.yaml
diff --git a/platform/cert-manager/README.md b/platform/cert-manager/README.md
index 153400b..82be516 100644
--- a/platform/cert-manager/README.md
+++ b/platform/cert-manager/README.md
@@ -51,6 +51,19 @@ the only challenge that can issue a wildcard.
 
 ## Deploy
 
+### Flux 接管状态
+
+现有 release 为 chart/app `v1.21.0`。Git 中固定同一版本，并用
+`suspend: true` 的 HelmRelease 分阶段接管：第一阶段只让 Flux 登记 source、values
+与 release 对象，不执行 Helm upgrade。确认 chart artifact、渲染结果和 live workload
+均未变化后，再通过独立 PR 解除暂停。
+
+Issuer 与 Certificate 清单随本目录的 Kustomization 由 Flux 管理；现有 Cloudflare
+token Secret 只被引用，本次接管不改变其所有权。删除保护期间保持 `prune: false`，且
+CRD 同时启用 chart 的 `crds.keep` 与 Flux Helm action 的 `CreateReplace`。
+
+以下命令保留为 break-glass 手工恢复流程；正常变更应提交 Git：
+
 ```bash
 helm repo add jetstack https://charts.jetstack.io && helm repo update jetstack
 helm upgrade --install cert-manager jetstack/cert-manager --version v1.21.0 \
diff --git a/platform/cert-manager/helmrelease.yaml b/platform/cert-manager/helmrelease.yaml
new file mode 100644
index 0000000..1e6e7f5
--- /dev/null
+++ b/platform/cert-manager/helmrelease.yaml
@@ -0,0 +1,35 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  # 第一阶段只登记现有 release；合并后确认 source 和渲染结果，再单独解除暂停。
+  suspend: true
+  chart:
+    spec:
+      chart: cert-manager
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+      version: v1.21.0
+  driftDetection:
+    mode: enabled
+  install:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: cert-manager
+  targetNamespace: cert-manager
+  timeout: 10m
+  upgrade:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  valuesFrom:
+    - kind: ConfigMap
+      name: cert-manager-values
diff --git a/platform/cert-manager/helmrepository.yaml b/platform/cert-manager/helmrepository.yaml
new file mode 100644
index 0000000..594fba7
--- /dev/null
+++ b/platform/cert-manager/helmrepository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: jetstack
+  namespace: cert-manager
+spec:
+  interval: 1h
+  url: https://charts.jetstack.io
diff --git a/platform/cert-manager/kustomization.yaml b/platform/cert-manager/kustomization.yaml
new file mode 100644
index 0000000..b1e3560
--- /dev/null
+++ b/platform/cert-manager/kustomization.yaml
@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    reconcile.fluxcd.io/watch: Enabled
+configMapGenerator:
+  - name: cert-manager-values
+    namespace: cert-manager
+    files:
+      - values.yaml=values.yaml
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - clusterissuer-letsencrypt.yaml
+  - clusterissuer-bao-acme.yaml
+  - certificate-wildcard-ad.yaml
+  - certificate-auth-ddupan.yaml
+  - certificate-git-ddupan.yaml