diff --git a/packages/extra/etcd/templates/etcd-cluster.yaml b/packages/extra/etcd/templates/etcd-cluster.yaml
index 44851cc60..a604b448c 100644
--- a/packages/extra/etcd/templates/etcd-cluster.yaml
+++ b/packages/extra/etcd/templates/etcd-cluster.yaml
@@ -104,6 +104,7 @@ spec:
       - {{ .Release.Name }}
   secretName: etcd-peer-ca-tls
   privateKey:
+    rotationPolicy: Never
     algorithm: RSA
     size: 4096
   issuerRef:
@@ -130,6 +131,7 @@ spec:
       - {{ .Release.Name }}
   secretName: etcd-ca-tls
   privateKey:
+    rotationPolicy: Never
     algorithm: RSA
     size: 4096
   issuerRef:
diff --git a/packages/system/cozystack-api/templates/certmanager.yaml b/packages/system/cozystack-api/templates/certmanager.yaml
index def27bd1e..4f73768ad 100644
--- a/packages/system/cozystack-api/templates/certmanager.yaml
+++ b/packages/system/cozystack-api/templates/certmanager.yaml
@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: cozystack-api-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml b/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
index db2946c3d..fab1e02ea 100644
--- a/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
+++ b/packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml
@@ -23,6 +23,8 @@ spec:
     name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer
   commonName: "ca.webhook.ingress-nginx"
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   subject:
     organizations:
       - ingress-nginx
diff --git a/packages/system/kubeovn-webhook/templates/certmanager.yaml b/packages/system/kubeovn-webhook/templates/certmanager.yaml
index be0f5af18..f8eee740e 100644
--- a/packages/system/kubeovn-webhook/templates/certmanager.yaml
+++ b/packages/system/kubeovn-webhook/templates/certmanager.yaml
@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: {{ include "namespace-annotation-webhook.fullname" . }}-selfsigned-issuer
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/lineage-controller-webhook/templates/certmanager.yaml b/packages/system/lineage-controller-webhook/templates/certmanager.yaml
index c2dc18d2f..11b7f21a0 100644
--- a/packages/system/lineage-controller-webhook/templates/certmanager.yaml
+++ b/packages/system/lineage-controller-webhook/templates/certmanager.yaml
@@ -18,6 +18,8 @@ spec:
   issuerRef:
     name: lineage-controller-webhook-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
index 3942555bd..760a9d5d4 100644
--- a/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
+++ b/packages/system/linstor-scheduler/charts/linstor-scheduler/templates/certmanager.yaml
@@ -24,6 +24,8 @@ spec:
   issuerRef:
     name: {{ include "linstor-scheduler.fullname" . }}-admission-selfsigned
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
diff --git a/packages/system/linstor/templates/linstor-api-tls.yaml b/packages/system/linstor/templates/linstor-api-tls.yaml
index eeda97310..055e6d082 100644
--- a/packages/system/linstor/templates/linstor-api-tls.yaml
+++ b/packages/system/linstor/templates/linstor-api-tls.yaml
@@ -9,6 +9,8 @@ spec:
   secretName: linstor-api-ca
   duration: 87600h # 10 years
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   usages:
     - signing
     - key encipherment
diff --git a/packages/system/linstor/templates/linstor-internal-tls.yaml b/packages/system/linstor/templates/linstor-internal-tls.yaml
index 5d5366252..fe5ff4b1f 100644
--- a/packages/system/linstor/templates/linstor-internal-tls.yaml
+++ b/packages/system/linstor/templates/linstor-internal-tls.yaml
@@ -9,6 +9,8 @@ spec:
   secretName: linstor-internal-ca
   duration: 87600h # 10 years
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   usages:
     - signing
     - key encipherment
diff --git a/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml b/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
index b01a8dcc0..a38287dea 100644
--- a/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
+++ b/packages/system/seaweedfs/charts/seaweedfs/templates/cert/ca-cert.yaml
@@ -13,6 +13,8 @@ spec:
   secretName: {{ template "seaweedfs.name" . }}-ca-cert
   commonName: "{{ template "seaweedfs.name" . }}-root-ca"
   isCA: true
+  privateKey:
+    rotationPolicy: Never
   {{- if .Values.certificates.ca.duration }}
   duration: {{ .Values.certificates.ca.duration }}
   {{- end }}
diff --git a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
index 2e027ab44..1bead84dd 100644
--- a/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
+++ b/packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/webhook.yaml
@@ -78,6 +78,8 @@ spec:
     name: {{ $fullname }}-root
   commonName: {{ $certManager.ca.commonName }}
   isCA: true
+  privateKey:
+    rotationPolicy: Never
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer