diff --git a/kube/deploy/core/secrets/external-secrets/app/hr.yaml b/kube/deploy/core/secrets/external-secrets/app/hr.yaml
index b4b5ff9a..3d6d33f4 100644
--- a/kube/deploy/core/secrets/external-secrets/app/hr.yaml
+++ b/kube/deploy/core/secrets/external-secrets/app/hr.yaml
@@ -29,15 +29,18 @@ spec:
         labelSelector:
           matchLabels:
             app.kubernetes.io/name: *app
-    # monitoring
+    certController:
+      podLabels:
+        # netpols
+        egress.home.arpa/apiserver: "allow"
+      # monitoring
+      serviceMonitor:
+        enabled: true
+        interval: 1m
     serviceMonitor:
       enabled: true
       interval: 1m
     webhook:
-      serviceMonitor:
-        enabled: true
-        interval: 1m
-    certController:
       serviceMonitor:
         enabled: true
         interval: 1m
\ No newline at end of file