diff --git a/go.mod b/go.mod
index 1ea482481691c45dc3871488ee0a0b7b6b48bed8..682990046233592c1fd21050e80da8ac4dde7529 100644
--- a/go.mod
+++ b/go.mod
@@ -72,7 +72,7 @@ require (
 	github.com/spf13/viper v1.15.0
 	github.com/vishvananda/netlink v1.2.1-beta.2
 	go.acides.org/daeman v0.3.4
-	go.acides.org/pekahi v0.1.1
+	go.acides.org/pekahi v0.2.0
 	go.acides.org/selfcontain v0.2.2
 	go.acides.org/sml v0.2.1
 	go.etcd.io/etcd/server/v3 v3.5.7
diff --git a/go.sum b/go.sum
index 4bb627373e27f1d8e1c8bd28de5c118d870c79ac..04395a4f474a04edd36b0082aa007749c2cfdc87 100644
--- a/go.sum
+++ b/go.sum
@@ -1330,6 +1330,8 @@ go.acides.org/daeman v0.3.4 h1:gjKq95TpP2+IMUkW/u1do4J43Y6KhTOPwOg6BBCBT74=
 go.acides.org/daeman v0.3.4/go.mod h1:fOZ4YudsVjbUan8WYTs0ED6JfpZ7Z6mlN4Lnn1qW5nk=
 go.acides.org/pekahi v0.1.1 h1:lohNKOhw9Fz5K1Q6K3tP7XFWc+d/O29D9AEXnY2EKU8=
 go.acides.org/pekahi v0.1.1/go.mod h1:AxgN7Ss6dCRHoNOVWMymkmDafWYdDV7ce6jPl5bqyRc=
+go.acides.org/pekahi v0.2.0 h1:TCw91qooXutg+XbRVmWR/42lJP16cvBDcPVo0soA3nI=
+go.acides.org/pekahi v0.2.0/go.mod h1:AxgN7Ss6dCRHoNOVWMymkmDafWYdDV7ce6jPl5bqyRc=
 go.acides.org/selfcontain v0.2.2 h1:QGrC7K/E9YPibBdo0IyWwkpNDHwhK2nJ/onpqsygqQk=
 go.acides.org/selfcontain v0.2.2/go.mod h1:cyKYsVw1scp6MTVIhquG+2OJrsyaDCwkXlsBvMO+cws=
 go.acides.org/sml v0.2.1 h1:WxlUUZqCzv+He91iyzURMwrjuB9FR+8rwe9nm+WR0y0=
diff --git a/services/cm.go b/services/cm.go
index 8b58e5c38488f243554f2a8deb1eab1f4d60d8e3..a048ed2514478a225e19e1b0acd95d98e0b366aa 100644
--- a/services/cm.go
+++ b/services/cm.go
@@ -2,6 +2,7 @@ package services
 
 import (
 	"context"
+	"encoding/pem"
 	"fmt"
 	"net"
 	"time"
@@ -120,12 +121,12 @@ var kubeControllerManager = &Unit{
 			clients.Informer.Core().V1().ConfigMaps(),
 			clients.Informer.Core().V1().Namespaces(),
 			clients.Client,
-			clients.KubeConfig.CAData,
+			pem.EncodeToMemory(c.pki.TLS.CertPEM()),
 		)
 		if err != nil {
 			return fmt.Errorf("could not initilialize root cert publisher: %w", err)
 		}
-		certPublisher.Run(ctx, 1)
+		go certPublisher.Run(ctx, 1)
 
 		//////////////////
 		/// Workloads