diff --git a/infrastructure/cert-manager/cert-manager.libsonnet b/infrastructure/cert-manager/cert-manager.libsonnet
index 0a7f7c3..7fc9402 100644
--- a/infrastructure/cert-manager/cert-manager.libsonnet
+++ b/infrastructure/cert-manager/cert-manager.libsonnet
@@ -20,6 +20,8 @@ local k = (import '../../prelude.libsonnet');
         namespaceSelector+: {
           matchExpressions: super.matchExpressions + [
             { key: 'control-plane', operator: 'DoesNotExist' },
+            { key: 'control-plane', operator: 'NotIn', values: ['true'] },
+            { key: 'kubernetes.azure.com/managedby', operator: 'NotIn', values: ['aks'] },
           ],
         },
       }] + super.webhooks[1:],