diff --git a/kubernetes/infrastructure/crowdsec/helmrelease.yaml b/kubernetes/infrastructure/crowdsec/helmrelease.yaml
index df3d5c6f..540dae32 100644
--- a/kubernetes/infrastructure/crowdsec/helmrelease.yaml
+++ b/kubernetes/infrastructure/crowdsec/helmrelease.yaml
@@ -73,6 +73,15 @@ spec:
         enabled: true
         # Empty => chart provisions its own self-signed CA (self-contained).
         issuerRef: {}
+        # Chart 0.24.0 bug: the agent/bouncer/appsec Certificate templates emit
+        # `secretTemplate:` unconditionally while its child blocks are guarded,
+        # so with nothing set it renders as null and cert-manager's webhook
+        # rejects it ("spec.secretTemplate ... must be of type object"). (The
+        # lapi cert template guards the whole key, which is why only the others
+        # failed.) Setting a label makes secretTemplate a valid non-null object.
+        secretTemplate:
+          labels:
+            app.kubernetes.io/part-of: crowdsec
       agent:
         tlsClientAuth: true