diff --git a/apps/victoriametrics/overlays/system/inject-ca-from.patch.yaml b/apps/victoriametrics/overlays/system/inject-ca-from.patch.yaml
new file mode 100644
index 0000000..45da980
--- /dev/null
+++ b/apps/victoriametrics/overlays/system/inject-ca-from.patch.yaml
@@ -0,0 +1,3 @@
+- op: add
+  path: /metadata/annotations/cert-manager.io~1inject-ca-from
+  value: "victoriametrics-system/vm-serving-cert"
diff --git a/apps/victoriametrics/overlays/system/kustomization.yaml b/apps/victoriametrics/overlays/system/kustomization.yaml
index 5830b19..7f94f4e 100644
--- a/apps/victoriametrics/overlays/system/kustomization.yaml
+++ b/apps/victoriametrics/overlays/system/kustomization.yaml
@@ -6,3 +6,14 @@ resources:
 namespace: victoriametrics-system
 patches:
   - path: certificate.patch.yaml
+  - path: inject-ca-from.patch.yaml
+    target:
+      group: apiextensions.k8s.io
+      version: v1
+      kind: CustomResourceDefinition
+      name: ".*victoriametrics.com"
+  - path: inject-ca-from.patch.yaml
+    target:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingWebhookConfiguration