diff --git a/gitops/manifests/vcluster/genmachine/genmachine-values.yaml b/gitops/manifests/vcluster/genmachine/genmachine-values.yaml
index e7ebd1f02..97f8f43a6 100644
--- a/gitops/manifests/vcluster/genmachine/genmachine-values.yaml
+++ b/gitops/manifests/vcluster/genmachine/genmachine-values.yaml
@@ -36,33 +36,34 @@ vcluster:
 
   telemetry:
     enabled: false
+
   experimental:
     deploy:
-      #     host:
-      #       manifests: |
-      #         ---
-      #         apiVersion: external-secrets.io/v1
-      #         kind: ExternalSecret
-      #         metadata:
-      #           name: vault-approle-ci
-      #         spec:
-      #           refreshInterval: 1h
-      #           secretStoreRef:
-      #             name: admin
-      #             kind: ClusterSecretStore
-      #           target:
-      #             name: vault-approle-ci
-      #             creationPolicy: Owner
-      #             deletionPolicy: Retain
-      #           data:
-      #             - secretKey: roleID
-      #               remoteRef:
-      #                 key: apps/ci-vcluster/approle
-      #                 property: ROLE_ID
-      #             - secretKey: secretID
-      #               remoteRef:
-      #                 key: apps/ci-vcluster/approle
-      #                 property: SECRET_ID
+      host:
+        manifests: |
+          ---
+          apiVersion: external-secrets.io/v1
+          kind: ExternalSecret
+          metadata:
+            name: vault-approle-ci
+          spec:
+            refreshInterval: 1h
+            secretStoreRef:
+              name: admin
+              kind: ClusterSecretStore
+            target:
+              name: vault-approle-ci
+              creationPolicy: Owner
+              deletionPolicy: Retain
+            data:
+              - secretKey: roleID
+                remoteRef:
+                  key: apps/ci-vcluster/approle
+                  property: ROLE_ID
+              - secretKey: secretID
+                remoteRef:
+                  key: apps/ci-vcluster/approle
+                  property: SECRET_ID
       vcluster:
         helm:
           - chart:
@@ -75,6 +76,13 @@ vcluster:
             values: |
               crds:
                 enabled: true
+              extraObjects:
+                - apiVersion: cert-manager.io/v1
+                  kind: ClusterIssuer
+                  metadata:
+                    name: selfsigned-issuer
+                  spec:
+                    selfSigned: {}
           - chart:
               name: external-secrets
               repo: https://charts.external-secrets.io
@@ -84,11 +92,3 @@ vcluster:
               namespace: external-secrets
             values: |
               installCRDs: true
-        manifests: |
-          ---
-          apiVersion: cert-manager.io/v1
-          kind: ClusterIssuer
-          metadata:
-            name: admin
-          spec:
-            selfSigned: {}