diff --git a/charts/base-cluster/templates/monitoring/kube-prometheus-stack/oauth-proxy.yaml b/charts/base-cluster/templates/monitoring/kube-prometheus-stack/oauth-proxy.yaml
index dc39e2e53..340c68265 100644
--- a/charts/base-cluster/templates/monitoring/kube-prometheus-stack/oauth-proxy.yaml
+++ b/charts/base-cluster/templates/monitoring/kube-prometheus-stack/oauth-proxy.yaml
@@ -36,7 +36,11 @@ spec:
       enabled: true
       hostname: {{ include (printf "base-cluster.%s.host" $host) $ }}
       tls: true
+      {{- if $.Values.dns.provider }}
+      selfSigned: true # `certManager: true` leads to overwritten wildcard certificates
+      {{- else }}
       certManager: true
+      {{- end }}
       existingSecretName: {{ include "base-cluster.certificate" (dict "name" $host "customDomain" $ingress.customDomain "context" $) | quote }}
     replicaCount: 2
     pdb: