diff --git a/Taskfile.yml b/Taskfile.yml
index 5e5b69ef9..63ac89079 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -36,6 +36,7 @@ tasks:
       - echo "GOOGLE_OAUTH_CLIENT_ID=__REPLACE__.apps.googleusercontent.com" >> deployment/local-dev/local.env
       - echo "GOOGLE_OAUTH_CLIENT_SECRET=__REPLACE__" >> deployment/local-dev/local.env
       - kubectl --context=docker-desktop apply -f deployment/setup/namespace.yaml
+      - kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.0/cert-manager.yaml
       - docker build -t local-dev-init data/
   setup-win:
     platforms: [ windows ]
diff --git a/deployment/local-dev/ingress-config.patch.yaml b/deployment/local-dev/ingress-config.patch.yaml
index e4678f4d5..a035e1fa2 100644
--- a/deployment/local-dev/ingress-config.patch.yaml
+++ b/deployment/local-dev/ingress-config.patch.yaml
@@ -1,7 +1,7 @@
-- op: replace
-  path: /spec/tls/0/secretName
-  value: null
-- op: add
+- op: add
 #  ~1 gets replaced with a / in the path
   path: /metadata/annotations/nginx.ingress.kubernetes.io~1ssl-redirect
   value: "false"
+- op: add
+  path: /metadata/annotations/cert-manager.io~1cluster-issuer
+  value: selfsigned-issuer
diff --git a/deployment/local-dev/kustomization.yaml b/deployment/local-dev/kustomization.yaml
index e2c0c624f..37d03473b 100644
--- a/deployment/local-dev/kustomization.yaml
+++ b/deployment/local-dev/kustomization.yaml
@@ -8,6 +8,7 @@ resources:
 - ingress-deployment.yaml
 - db-secrets.yaml
 - lf-classic-secrets.yaml
+- self-signed-ssl.yaml
 
 components:
   - ../init-repos
diff --git a/deployment/local-dev/self-signed-ssl.yaml b/deployment/local-dev/self-signed-ssl.yaml
new file mode 100644
index 000000000..2ed283b50
--- /dev/null
+++ b/deployment/local-dev/self-signed-ssl.yaml
@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: { }