diff --git a/packages/system/vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml b/packages/system/vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml
index 0a2d8ecf3..b62688cef 100644
--- a/packages/system/vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml
+++ b/packages/system/vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml
@@ -78,17 +78,20 @@ spec:
               rotated since the last render — Kubernetes rolls the pod
               on the resulting podTemplate change.
             - Between Helm actions the pod holds the certificate it
-              loaded at startup. If cert-manager renews at day ~350 and
-              NO Helm action happens in the following ~15 days, the pod
-              keeps serving with an expired in-memory cert (--reload-
-              cert alone would make this worse — the mounted cert would
-              rotate while the pod's self-registered
-              MutatingWebhookConfiguration caBundle went stale). Given
+              loaded at startup. With `duration: 8760h` (365d) and
+              `renewBefore: 2160h` (90d) in `certificate.yaml`,
+              cert-manager rotates the Secret at day ~275; if NO Helm
+              action fires in the following ~90 days, the pod keeps
+              serving with an expired in-memory cert past day 365
+              (--reload-cert alone would make this worse — the mounted
+              cert would rotate while the pod's self-registered
+              MutatingWebhookConfiguration caBundle went stale). At
               cozystack's release cadence a Helm action realistically
-              lands well before day 365, so we accept this. If ever it
-              stops holding, a small post-renewal Job that annotates
-              the Deployment podTemplate would close the gap without
-              re-introducing the ReplicaSet-churn amplifier.
+              lands well within that 90-day post-rotation window, so
+              we accept this. If ever it stops holding, a small
+              post-renewal Job that annotates the Deployment
+              podTemplate would close the gap without re-introducing
+              the ReplicaSet-churn amplifier.
 
           `lookup` returns nil during `helm template --dry-run=client`
           (offline CI renders / this chart's helm-unittest suite) — that
diff --git a/packages/system/vertical-pod-autoscaler/patches/cert-manager-admission-tls.diff b/packages/system/vertical-pod-autoscaler/patches/cert-manager-admission-tls.diff
index 1c00b6c47..4a718c9a3 100644
--- a/packages/system/vertical-pod-autoscaler/patches/cert-manager-admission-tls.diff
+++ b/packages/system/vertical-pod-autoscaler/patches/cert-manager-admission-tls.diff
@@ -144,10 +144,10 @@ index 0000000..ad99d64
 +*/}}
 +{{- end }}
 diff --git a/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml b/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml
-index b7a9237..0a2d8ec 100644
+index b7a9237..b62688c 100644
 --- a/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml
 +++ b/charts/vertical-pod-autoscaler/templates/admission-controller/deployment.yaml
-@@ -30,9 +30,100 @@ spec:
+@@ -30,9 +30,103 @@ spec:
          {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 8 }}
          {{- end }}
        annotations:
@@ -200,17 +200,20 @@ index b7a9237..0a2d8ec 100644
 +              rotated since the last render — Kubernetes rolls the pod
 +              on the resulting podTemplate change.
 +            - Between Helm actions the pod holds the certificate it
-+              loaded at startup. If cert-manager renews at day ~350 and
-+              NO Helm action happens in the following ~15 days, the pod
-+              keeps serving with an expired in-memory cert (--reload-
-+              cert alone would make this worse — the mounted cert would
-+              rotate while the pod's self-registered
-+              MutatingWebhookConfiguration caBundle went stale). Given
++              loaded at startup. With `duration: 8760h` (365d) and
++              `renewBefore: 2160h` (90d) in `certificate.yaml`,
++              cert-manager rotates the Secret at day ~275; if NO Helm
++              action fires in the following ~90 days, the pod keeps
++              serving with an expired in-memory cert past day 365
++              (--reload-cert alone would make this worse — the mounted
++              cert would rotate while the pod's self-registered
++              MutatingWebhookConfiguration caBundle went stale). At
 +              cozystack's release cadence a Helm action realistically
-+              lands well before day 365, so we accept this. If ever it
-+              stops holding, a small post-renewal Job that annotates
-+              the Deployment podTemplate would close the gap without
-+              re-introducing the ReplicaSet-churn amplifier.
++              lands well within that 90-day post-rotation window, so
++              we accept this. If ever it stops holding, a small
++              post-renewal Job that annotates the Deployment
++              podTemplate would close the gap without re-introducing
++              the ReplicaSet-churn amplifier.
 +
 +          `lookup` returns nil during `helm template --dry-run=client`
 +          (offline CI renders / this chart's helm-unittest suite) — that