diff --git a/values/clusters/unraid-lab/cert-manager.yaml b/values/clusters/unraid-lab/cert-manager.yaml
new file mode 100644
index 0000000..56f8003
--- /dev/null
+++ b/values/clusters/unraid-lab/cert-manager.yaml
@@ -0,0 +1,14 @@
+# Keep cert-manager off the Imp runner. It may use a control-plane node.
+tolerations: &control_plane_toleration
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+webhook:
+  tolerations: *control_plane_toleration
+
+cainjector:
+  tolerations: *control_plane_toleration
+
+startupapicheck:
+  tolerations: *control_plane_toleration