diff --git a/.gitlab/ci_scripts/install_zerossl_issuer.sh b/.gitlab/ci_scripts/install_zerossl_issuer.sh
index 0aaefbb456f25c7de34ebbe6761c0986f9e922e9..855cc440a1420cda803c030f9b03d9bd077f9d0f 100755
--- a/.gitlab/ci_scripts/install_zerossl_issuer.sh
+++ b/.gitlab/ci_scripts/install_zerossl_issuer.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Waits until ClusterIssuer crd exists, and then installs a ZeroSSL
+# Waits until cert-manager HelmRelease is ready, and then installs a ZeroSSL
 # ClusterIssuer with our credentials into the cert-manager namespace
 #
 # Usage:
@@ -11,8 +11,8 @@ set -euo pipefail
 # Create secret with HMAC key
 kubectl -n cert-manager create secret generic zerossl-eabsecret --from-literal "secret=${ZEROSSL_EAB_HMAC_KEY}"
 
-# Wait until ClusterIssuer CRD exists
-"$(dirname "$0")/retry_cmd_until_success.sh" 30 10 kubectl get crd clusterissuers.cert-manager.io
+# Wait until cert-manager is ready
+"$(dirname "$0")/retry_cmd_until_success.sh" 30 10 "flux get helmrelease -n cert-manager --status-selector ready=true --no-header | grep cert-manager"
 
 # Add ZeroSSL ClusterIssuer
 kubectl apply -n cert-manager -f - <<EOF