diff --git a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
index e35f73e8..9209662a 100644
--- a/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
+++ b/packages/system/cert-manager-issuers/templates/cluster-issuers.yaml
@@ -24,7 +24,14 @@ solvers:
 {{/* Dual parentRef: acme-challenge accepts system namespaces (Selector),
      http-redirect accepts the gateway's own namespace (Same). Each challenge
      HTTPRoute will have one accepted and one rejected parent — this is
-     expected, cert-manager handles partial acceptance correctly. */}}
+     expected, cert-manager handles partial acceptance correctly.
+
+     Limitation: Gateway API ACME HTTP-01 only works for the root tenant
+     and system services. Child tenants with gateway: true have their own
+     Gateways but the ClusterIssuer always references the root tenant's
+     Gateways. Child tenant challenges will be rejected by both (no system
+     label, different namespace). Child tenants should use dns01 solver or
+     namespace-scoped Issuers. */}}
 {{- if and (eq $gatewayAPI "true") (ne $gateway "") }}
 - http01:
     gatewayHTTPRoute:
@@ -64,13 +71,13 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-stage
     server: https://acme-staging-v02.api.letsencrypt.org/directory
-{{ include "cert-manager-issuers.solvers" (list $solver $ingressEnabled $gatewayAPI $gateway) | indent 4 }}  
+{{ include "cert-manager-issuers.solvers" (list $solver $ingressEnabled $gatewayAPI $gateway) | indent 4 }}
 
----  
+---
 
-apiVersion: cert-manager.io/v1  
-kind: ClusterIssuer  
-metadata:  
-  name: selfsigned-cluster-issuer  
-spec:  
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-cluster-issuer
+spec:
   selfSigned: {}