diff --git a/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl b/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl
index ab804f99..78ed1384 100644
--- a/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl
+++ b/apis/concierge/config/v1alpha1/types_credentialissuer.go.tmpl
@@ -101,7 +101,7 @@ type TokenCredentialRequestAPIInfo struct {
 	// +kubebuilder:validation:Pattern=`^https://|^http://`
 	Server string `json:"server"`
 
-	// CertificateAuthorityData is the Kubernetes API server CA bundle.
+	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 	// +kubebuilder:validation:MinLength=1
 	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }
diff --git a/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml b/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml
index 13d71b72..5ae6b3fb 100644
--- a/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/deploy/concierge/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -93,8 +93,8 @@ spec:
                             Concierge. This field is only set when Type is "TokenCredentialRequestAPI".
                           properties:
                             certificateAuthorityData:
-                              description: CertificateAuthorityData is the Kubernetes
-                                API server CA bundle.
+                              description: CertificateAuthorityData is the base64-encoded
+                                Kubernetes API server CA bundle.
                               minLength: 1
                               type: string
                             server:
diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc
index 1b43c089..b062b7f4 100644
--- a/generated/1.17/README.adoc
+++ b/generated/1.17/README.adoc
@@ -347,7 +347,7 @@ Status of a credential issuer.
 |===
 | Field | Description
 | *`server`* __string__ | Server is the Kubernetes API server URL.
-| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the Kubernetes API server CA bundle.
+| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 |===
 
 
diff --git a/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go
index ab804f99..78ed1384 100644
--- a/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.17/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -101,7 +101,7 @@ type TokenCredentialRequestAPIInfo struct {
 	// +kubebuilder:validation:Pattern=`^https://|^http://`
 	Server string `json:"server"`
 
-	// CertificateAuthorityData is the Kubernetes API server CA bundle.
+	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 	// +kubebuilder:validation:MinLength=1
 	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }
diff --git a/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 13d71b72..5ae6b3fb 100644
--- a/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.17/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -93,8 +93,8 @@ spec:
                             Concierge. This field is only set when Type is "TokenCredentialRequestAPI".
                           properties:
                             certificateAuthorityData:
-                              description: CertificateAuthorityData is the Kubernetes
-                                API server CA bundle.
+                              description: CertificateAuthorityData is the base64-encoded
+                                Kubernetes API server CA bundle.
                               minLength: 1
                               type: string
                             server:
diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc
index 54aa378a..18ec63f7 100644
--- a/generated/1.18/README.adoc
+++ b/generated/1.18/README.adoc
@@ -347,7 +347,7 @@ Status of a credential issuer.
 |===
 | Field | Description
 | *`server`* __string__ | Server is the Kubernetes API server URL.
-| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the Kubernetes API server CA bundle.
+| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 |===
 
 
diff --git a/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go
index ab804f99..78ed1384 100644
--- a/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.18/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -101,7 +101,7 @@ type TokenCredentialRequestAPIInfo struct {
 	// +kubebuilder:validation:Pattern=`^https://|^http://`
 	Server string `json:"server"`
 
-	// CertificateAuthorityData is the Kubernetes API server CA bundle.
+	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 	// +kubebuilder:validation:MinLength=1
 	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }
diff --git a/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 13d71b72..5ae6b3fb 100644
--- a/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.18/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -93,8 +93,8 @@ spec:
                             Concierge. This field is only set when Type is "TokenCredentialRequestAPI".
                           properties:
                             certificateAuthorityData:
-                              description: CertificateAuthorityData is the Kubernetes
-                                API server CA bundle.
+                              description: CertificateAuthorityData is the base64-encoded
+                                Kubernetes API server CA bundle.
                               minLength: 1
                               type: string
                             server:
diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc
index 69fc53f1..612620fe 100644
--- a/generated/1.19/README.adoc
+++ b/generated/1.19/README.adoc
@@ -347,7 +347,7 @@ Status of a credential issuer.
 |===
 | Field | Description
 | *`server`* __string__ | Server is the Kubernetes API server URL.
-| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the Kubernetes API server CA bundle.
+| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 |===
 
 
diff --git a/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go
index ab804f99..78ed1384 100644
--- a/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.19/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -101,7 +101,7 @@ type TokenCredentialRequestAPIInfo struct {
 	// +kubebuilder:validation:Pattern=`^https://|^http://`
 	Server string `json:"server"`
 
-	// CertificateAuthorityData is the Kubernetes API server CA bundle.
+	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 	// +kubebuilder:validation:MinLength=1
 	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }
diff --git a/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 13d71b72..5ae6b3fb 100644
--- a/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.19/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -93,8 +93,8 @@ spec:
                             Concierge. This field is only set when Type is "TokenCredentialRequestAPI".
                           properties:
                             certificateAuthorityData:
-                              description: CertificateAuthorityData is the Kubernetes
-                                API server CA bundle.
+                              description: CertificateAuthorityData is the base64-encoded
+                                Kubernetes API server CA bundle.
                               minLength: 1
                               type: string
                             server:
diff --git a/generated/1.20/README.adoc b/generated/1.20/README.adoc
index d666180e..97b02d4e 100644
--- a/generated/1.20/README.adoc
+++ b/generated/1.20/README.adoc
@@ -347,7 +347,7 @@ Status of a credential issuer.
 |===
 | Field | Description
 | *`server`* __string__ | Server is the Kubernetes API server URL.
-| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the Kubernetes API server CA bundle.
+| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 |===
 
 
diff --git a/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go
index ab804f99..78ed1384 100644
--- a/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/1.20/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -101,7 +101,7 @@ type TokenCredentialRequestAPIInfo struct {
 	// +kubebuilder:validation:Pattern=`^https://|^http://`
 	Server string `json:"server"`
 
-	// CertificateAuthorityData is the Kubernetes API server CA bundle.
+	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 	// +kubebuilder:validation:MinLength=1
 	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }
diff --git a/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml b/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml
index 13d71b72..5ae6b3fb 100644
--- a/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml
+++ b/generated/1.20/crds/config.concierge.pinniped.dev_credentialissuers.yaml
@@ -93,8 +93,8 @@ spec:
                             Concierge. This field is only set when Type is "TokenCredentialRequestAPI".
                           properties:
                             certificateAuthorityData:
-                              description: CertificateAuthorityData is the Kubernetes
-                                API server CA bundle.
+                              description: CertificateAuthorityData is the base64-encoded
+                                Kubernetes API server CA bundle.
                               minLength: 1
                               type: string
                             server:
diff --git a/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go b/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go
index ab804f99..78ed1384 100644
--- a/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go
+++ b/generated/latest/apis/concierge/config/v1alpha1/types_credentialissuer.go
@@ -101,7 +101,7 @@ type TokenCredentialRequestAPIInfo struct {
 	// +kubebuilder:validation:Pattern=`^https://|^http://`
 	Server string `json:"server"`
 
-	// CertificateAuthorityData is the Kubernetes API server CA bundle.
+	// CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle.
 	// +kubebuilder:validation:MinLength=1
 	CertificateAuthorityData string `json:"certificateAuthorityData"`
 }