diff --git a/deploy/crds/crd-certificaterequests.yaml b/deploy/crds/crd-certificaterequests.yaml
index 44c7640c7..980fb3ac8 100644
--- a/deploy/crds/crd-certificaterequests.yaml
+++ b/deploy/crds/crd-certificaterequests.yaml
@@ -2,10 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: certificaterequests.cert-manager.io
-  labels:
-    {{- if .Values.crds.keep }}
+  {{- if .Values.crds.keep }}
+  annotations:
     "helm.sh/resource-policy": keep
-    {{- end }}
+  {{- end }}
+  labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/instance: '{{ .Release.Name }}'
diff --git a/deploy/crds/crd-certificates.yaml b/deploy/crds/crd-certificates.yaml
index a79bd2db4..0753607df 100644
--- a/deploy/crds/crd-certificates.yaml
+++ b/deploy/crds/crd-certificates.yaml
@@ -2,10 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: certificates.cert-manager.io
-  labels:
-    {{- if .Values.crds.keep }}
+  {{- if .Values.crds.keep }}
+  annotations:
     "helm.sh/resource-policy": keep
-    {{- end }}
+  {{- end }}
+  labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/instance: '{{ .Release.Name }}'
diff --git a/deploy/crds/crd-challenges.yaml b/deploy/crds/crd-challenges.yaml
index 4b2c5bf6b..315012b31 100644
--- a/deploy/crds/crd-challenges.yaml
+++ b/deploy/crds/crd-challenges.yaml
@@ -2,10 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: challenges.acme.cert-manager.io
-  labels:
-    {{- if .Values.crds.keep }}
+  {{- if .Values.crds.keep }}
+  annotations:
     "helm.sh/resource-policy": keep
-    {{- end }}
+  {{- end }}
+  labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/instance: '{{ .Release.Name }}'
diff --git a/deploy/crds/crd-clusterissuers.yaml b/deploy/crds/crd-clusterissuers.yaml
index f60fbf792..824e7db80 100644
--- a/deploy/crds/crd-clusterissuers.yaml
+++ b/deploy/crds/crd-clusterissuers.yaml
@@ -3,10 +3,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: clusterissuers.cert-manager.io
-  labels:
-    {{- if .Values.crds.keep }}
+  {{- if .Values.crds.keep }}
+  annotations:
     "helm.sh/resource-policy": keep
-    {{- end }}
+  {{- end }}
+  labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/instance: "{{ .Release.Name }}"
diff --git a/deploy/crds/crd-issuers.yaml b/deploy/crds/crd-issuers.yaml
index f0602811e..34ac9df07 100644
--- a/deploy/crds/crd-issuers.yaml
+++ b/deploy/crds/crd-issuers.yaml
@@ -2,10 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: issuers.cert-manager.io
-  labels:
-    {{- if .Values.crds.keep }}
+  {{- if .Values.crds.keep }}
+  annotations:
     "helm.sh/resource-policy": keep
-    {{- end }}
+  {{- end }}
+  labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/instance: "{{ .Release.Name }}"
diff --git a/deploy/crds/crd-orders.yaml b/deploy/crds/crd-orders.yaml
index 9b22b1746..de211b11a 100644
--- a/deploy/crds/crd-orders.yaml
+++ b/deploy/crds/crd-orders.yaml
@@ -2,10 +2,11 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: orders.acme.cert-manager.io
-  labels:
-    {{- if .Values.crds.keep }}
+  {{- if .Values.crds.keep }}
+  annotations:
     "helm.sh/resource-policy": keep
-    {{- end }}
+  {{- end }}
+  labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/instance: '{{ .Release.Name }}'