diff --git a/deploy/crds/crd-clusterissuers.yaml b/deploy/crds/crd-clusterissuers.yaml
index 55ed02a51..8d1afb6c0 100644
--- a/deploy/crds/crd-clusterissuers.yaml
+++ b/deploy/crds/crd-clusterissuers.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
     # Generated labels {{- include "labels" . | nindent 4 }}
 spec:
   group: cert-manager.io
@@ -1161,7 +1161,7 @@ spec:
                                   description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                   type: string
                             serviceAccountRef:
-                              description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. See <link to a page in cert-manager.io> to learn more.
+                              description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token.
                               type: object
                               required:
                                 - name
diff --git a/deploy/crds/crd-issuers.yaml b/deploy/crds/crd-issuers.yaml
index 93d422e94..4b827abf9 100644
--- a/deploy/crds/crd-issuers.yaml
+++ b/deploy/crds/crd-issuers.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     app: '{{ template "cert-manager.name" . }}'
     app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
-    app.kubernetes.io/instance: '{{ .Release.Name }}'
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
     # Generated labels {{- include "labels" . | nindent 4 }}
 spec:
   group: cert-manager.io
@@ -1161,7 +1161,7 @@ spec:
                                   description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                   type: string
                             serviceAccountRef:
-                              description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. See <link to a page in cert-manager.io> to learn more.
+                              description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token.
                               type: object
                               required:
                                 - name
diff --git a/internal/apis/certmanager/types_issuer.go b/internal/apis/certmanager/types_issuer.go
index c2b3b3597..38f7438fb 100644
--- a/internal/apis/certmanager/types_issuer.go
+++ b/internal/apis/certmanager/types_issuer.go
@@ -252,7 +252,7 @@ type VaultKubernetesAuth struct {
 	// token (also known as "projected token"). Compared to using "secretRef",
 	// using this field means that you don't rely on statically bound tokens. To
 	// use this field, you must configure an RBAC rule to let cert-manager
-	// request a token. See <link to a page in cert-manager.io> to learn more.
+	// request a token.
 	// +optional
 	ServiceAccountRef *ServiceAccountRef
 
diff --git a/internal/apis/certmanager/v1alpha2/types_issuer.go b/internal/apis/certmanager/v1alpha2/types_issuer.go
index 601f42626..32fbeb2e6 100644
--- a/internal/apis/certmanager/v1alpha2/types_issuer.go
+++ b/internal/apis/certmanager/v1alpha2/types_issuer.go
@@ -272,7 +272,7 @@ type VaultKubernetesAuth struct {
 	// token (also known as "projected token"). Compared to using "secretRef",
 	// using this field means that you don't rely on statically bound tokens. To
 	// use this field, you must configure an RBAC rule to let cert-manager
-	// request a token. See <link to a page in cert-manager.io> to learn more.
+	// request a token.
 	// +optional
 	ServiceAccountRef *ServiceAccountRef `json:"serviceAccountRef,omitempty"`
 
diff --git a/internal/apis/certmanager/v1alpha3/types_issuer.go b/internal/apis/certmanager/v1alpha3/types_issuer.go
index 101f56c26..a512cb933 100644
--- a/internal/apis/certmanager/v1alpha3/types_issuer.go
+++ b/internal/apis/certmanager/v1alpha3/types_issuer.go
@@ -272,7 +272,7 @@ type VaultKubernetesAuth struct {
 	// token (also known as "projected token"). Compared to using "secretRef",
 	// using this field means that you don't rely on statically bound tokens. To
 	// use this field, you must configure an RBAC rule to let cert-manager
-	// request a token. See <link to a page in cert-manager.io> to learn more.
+	// request a token.
 	// +optional
 	ServiceAccountRef *ServiceAccountRef `json:"serviceAccountRef,omitempty"`
 
diff --git a/internal/apis/certmanager/v1beta1/types_issuer.go b/internal/apis/certmanager/v1beta1/types_issuer.go
index d420cee40..6bbf12583 100644
--- a/internal/apis/certmanager/v1beta1/types_issuer.go
+++ b/internal/apis/certmanager/v1beta1/types_issuer.go
@@ -274,7 +274,7 @@ type VaultKubernetesAuth struct {
 	// token (also known as "projected token"). Compared to using "secretRef",
 	// using this field means that you don't rely on statically bound tokens. To
 	// use this field, you must configure an RBAC rule to let cert-manager
-	// request a token. See <link to a page in cert-manager.io> to learn more.
+	// request a token.
 	// +optional
 	ServiceAccountRef *ServiceAccountRef `json:"serviceAccountRef,omitempty"`
 
diff --git a/pkg/apis/certmanager/v1/types_issuer.go b/pkg/apis/certmanager/v1/types_issuer.go
index 77aaec772..c901d9e7a 100644
--- a/pkg/apis/certmanager/v1/types_issuer.go
+++ b/pkg/apis/certmanager/v1/types_issuer.go
@@ -277,7 +277,7 @@ type VaultKubernetesAuth struct {
 	// token (also known as "projected token"). Compared to using "secretRef",
 	// using this field means that you don't rely on statically bound tokens. To
 	// use this field, you must configure an RBAC rule to let cert-manager
-	// request a token. See <link to a page in cert-manager.io> to learn more.
+	// request a token.
 	// +optional
 	ServiceAccountRef *ServiceAccountRef `json:"serviceAccountRef,omitempty"`