diff --git a/deploy/base/ingress.yaml b/deploy/base/ingress.yaml
index 2f9005f..bfad830 100644
--- a/deploy/base/ingress.yaml
+++ b/deploy/base/ingress.yaml
@@ -2,6 +2,12 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ingress
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 5m
+    nginx.ingress.kubernetes.io/server-snippet: |
+      if ($http_user_agent ~* "BLEXBot|SemrushBot" ) {
+        return 403;
+      }
 spec:
   ingressClassName: nginx
   # NOTE: overlays depend on the order of rule entries.
diff --git a/deploy/prod/ingress.yaml b/deploy/prod/ingress.yaml
index f542f47..883ec46 100644
--- a/deploy/prod/ingress.yaml
+++ b/deploy/prod/ingress.yaml
@@ -2,9 +2,9 @@
   path: /spec/ingressClassName
   value: prod-nginx
 - op: add
-  path: /metadata/annotations
-  value:
-    cert-manager.io/cluster-issuer: letsencrypt-production
+  # https://github.com/kubernetes-sigs/kustomize/issues/1439#issuecomment-520614831
+  path: /metadata/annotations/cert-manager.io~1cluster-issuer
+  value: letsencrypt-production
 - op: replace
   path: /spec/tls
   value: