diff --git a/k8s-ng/core/cert-manager/issuer.yaml b/k8s-ng/core/cert-manager/issuer.yaml
index 154330b..e84ac08 100644
--- a/k8s-ng/core/cert-manager/issuer.yaml
+++ b/k8s-ng/core/cert-manager/issuer.yaml
@@ -1,4 +1,5 @@
-# Public certificates through DNS-01. The credential Secrets are created by hand
+# Public certificates through DNS-01 for the zones below and HTTP-01 (Traefik) for
+# every other domain, e.g. the .рф one. The credential Secrets are created by hand
 # (they will move to Vaultwarden + External Secrets):
 #   kubectl -n cert-manager create secret generic cloudflare-api-token --from-literal=apiToken=<token>
 #     (Zone:DNS:Edit on the btwiusearch.net zone)
@@ -36,3 +37,8 @@ spec:
             secretAccessKeySecretRef:
               name: aws-api-key-secret
               key: secretKey
+      # Fallback for domains outside the zones above: their A records must point
+      # at the cluster nodes (Traefik answers on port 80 everywhere).
+      - http01:
+          ingress:
+            ingressClassName: traefik