diff --git a/deploy/crds/crd-clusterissuers.yaml b/deploy/crds/crd-clusterissuers.yaml
index 60bdf095f..8c336f3bf 100644
--- a/deploy/crds/crd-clusterissuers.yaml
+++ b/deploy/crds/crd-clusterissuers.yaml
@@ -137,10 +137,11 @@ spec:
                             info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                           type: string
                 privateKeySecretRef:
-                  description: PrivateKey is the name of a Secret resource that will
-                    be used to store the automatically generated ACME account private
-                    key. If `key` is not specified, a default of `tls.key` will be
-                    used.
+                  description: PrivateKey is the name of a Kubernetes Secret resource
+                    that will be used to store the automatically generated ACME account
+                    private key. Optionally, a `key` may be specified to select a
+                    specific entry within the named Secret resource. If `key` is not
+                    specified, a default of `tls.key` will be used.
                   type: object
                   required:
                   - name
@@ -156,12 +157,13 @@ spec:
                       type: string
                 server:
                   description: 'Server is the URL used to access the ACME server''s
-                    ''directory'' endpoint. For examples, for Let''s Encrypt''s staging
+                    ''directory'' endpoint. For example, for Let''s Encrypt''s staging
                     endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory".
                     Only ACME v2 endpoints (i.e. RFC 8555) are supported.'
                   type: string
                 skipTLSVerify:
-                  description: If true, requests to the ACME server will not have
+                  description: Enables or disables validation of the ACME server TLS
+                    certificate. If true, requests to the ACME server will not have
                     their TLS certificate validated (i.e. insecure connections will
                     be allowed). Only enable this option in development environments.
                     The cert-manager system installed roots will be used to verify
@@ -1673,7 +1675,9 @@ spec:
                           type: string
                         secretRef:
                           description: Reference to a key in a Secret that contains
-                            the App Role secret used to authenticate with Vault.
+                            the App Role secret used to authenticate with Vault. The
+                            `key` field must be specified and denotes which entry
+                            within the Secret resource is used as the app role secret.
                           type: object
                           required:
                           - name
diff --git a/deploy/crds/crd-issuers.yaml b/deploy/crds/crd-issuers.yaml
index 620545e35..f4867c3dd 100644
--- a/deploy/crds/crd-issuers.yaml
+++ b/deploy/crds/crd-issuers.yaml
@@ -136,10 +136,11 @@ spec:
                             info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                           type: string
                 privateKeySecretRef:
-                  description: PrivateKey is the name of a Secret resource that will
-                    be used to store the automatically generated ACME account private
-                    key. If `key` is not specified, a default of `tls.key` will be
-                    used.
+                  description: PrivateKey is the name of a Kubernetes Secret resource
+                    that will be used to store the automatically generated ACME account
+                    private key. Optionally, a `key` may be specified to select a
+                    specific entry within the named Secret resource. If `key` is not
+                    specified, a default of `tls.key` will be used.
                   type: object
                   required:
                   - name
@@ -155,12 +156,13 @@ spec:
                       type: string
                 server:
                   description: 'Server is the URL used to access the ACME server''s
-                    ''directory'' endpoint. For examples, for Let''s Encrypt''s staging
+                    ''directory'' endpoint. For example, for Let''s Encrypt''s staging
                     endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory".
                     Only ACME v2 endpoints (i.e. RFC 8555) are supported.'
                   type: string
                 skipTLSVerify:
-                  description: If true, requests to the ACME server will not have
+                  description: Enables or disables validation of the ACME server TLS
+                    certificate. If true, requests to the ACME server will not have
                     their TLS certificate validated (i.e. insecure connections will
                     be allowed). Only enable this option in development environments.
                     The cert-manager system installed roots will be used to verify
@@ -1672,7 +1674,9 @@ spec:
                           type: string
                         secretRef:
                           description: Reference to a key in a Secret that contains
-                            the App Role secret used to authenticate with Vault.
+                            the App Role secret used to authenticate with Vault. The
+                            `key` field must be specified and denotes which entry
+                            within the Secret resource is used as the app role secret.
                           type: object
                           required:
                           - name