diff --git a/apps/mcpacks/ingress.yaml b/apps/mcpacks/ingress.yaml
index 3a33f0e..9862075 100644
--- a/apps/mcpacks/ingress.yaml
+++ b/apps/mcpacks/ingress.yaml
@@ -6,10 +6,10 @@ metadata:
   name: mcpacks
   namespace: mcpacks
   annotations:
-    # Prove DNS-01 issuance with Let's Encrypt's untrusted staging service
-    # first. Change this to letsencrypt-prod only after the staging Certificate
-    # is Ready; production has strict rate limits for repeated mistakes.
-    cert-manager.io/cluster-issuer: letsencrypt
+    # Staging issuance has been verified, so use Let's Encrypt's publicly
+    # trusted production service. Production has strict rate limits; test any
+    # future hostname or solver change against letsencrypt-staging first.
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   tls:
     - hosts: