diff --git a/docs/upgrade-k8s-1.33.md b/docs/upgrade-k8s-1.33.md
index 4ed2285..04d1c5c 100644
--- a/docs/upgrade-k8s-1.33.md
+++ b/docs/upgrade-k8s-1.33.md
@@ -88,7 +88,8 @@ snapshots after every step. Fresh Velero backup before starting.
 
 ## 8. After 1.33
 
-- [ ] cert-manager 1.21.2
+- [x] cert-manager 1.21.2. The chart dropped the unused tokenrequest Role and
+  RoleBinding; Argo CD pruned them
 - [ ] Envoy Gateway v1.9 instead of ingress-nginx, Longhorn behind authentik
   OIDC