diff --git a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
index 43a3ac79..577e0d4f 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
@@ -143,6 +143,60 @@ locals {
       "service.beta.kubernetes.io/aws-load-balancer-ssl-ports" = "443"
     } : {}
   )
+
+  # ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
+  # and exports them to K8s TLS secrets for Gateway listener consumption.
+  ack_acm_resources = local.use_ack_acm ? {
+    for domain_key, domain in local.acm_cert_domains :
+    "ack-acm-cert-${domain_key}" => {
+      apiVersion = "acm.services.k8s.aws/v1alpha1"
+      kind       = "Certificate"
+      metadata = {
+        name      = "${local.name}-acm-cert-${domain_key}"
+        namespace = var.environment.namespace
+      }
+      spec = {
+        domainName = "*.${domain.domain}"
+        subjectAlternativeNames = [
+          domain.domain,
+          "*.${domain.domain}"
+        ]
+        validationMethod = "DNS"
+        options = {
+          certificateTransparencyLoggingPreference = "ENABLED"
+        }
+        exportTo = {
+          namespace = var.environment.namespace
+          name      = local.acm_cert_secret_names[domain_key]
+          key       = "tls.crt"
+        }
+      }
+    }
+  } : {}
+
+  # DNS-01 wildcard certificate resources for cert-manager
+  dns01_certificate_resources = {
+    for domain_key, domain in local.all_dns01_domains :
+    "dns01-cert-${domain_key}" => {
+      apiVersion = "cert-manager.io/v1"
+      kind       = "Certificate"
+      metadata = {
+        name      = "${local.name}-dns01-cert-${domain_key}"
+        namespace = var.environment.namespace
+      }
+      spec = {
+        secretName = local.dns01_cert_secret_names[domain_key]
+        issuerRef = {
+          name = local.dns01_cluster_issuer
+          kind = "ClusterIssuer"
+        }
+        dnsNames = [
+          domain.domain,
+          "*.${domain.domain}"
+        ]
+      }
+    }
+  }
 }
 
 # Call the base utility module
@@ -168,44 +222,8 @@ module "nginx_gateway_fabric" {
       }]
     }
   }
-}
-
-# ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
-# and exports them to K8s TLS secrets for Gateway listener consumption.
-# Only created when ACK controller is available and domains have ACM ARNs.
-# When ACK is not available, ACM certs are attached directly to the NLB instead.
-module "ack_acm_certificate" {
-  for_each = local.use_ack_acm ? local.acm_cert_domains : {}
-
-  source          = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
-  name            = "${local.name}-acm-cert-${each.key}"
-  namespace       = var.environment.namespace
-  advanced_config = {}
 
-  data = {
-    apiVersion = "acm.services.k8s.aws/v1alpha1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "${local.name}-acm-cert-${each.key}"
-      namespace = var.environment.namespace
-    }
-    spec = {
-      domainName = "*.${each.value.domain}"
-      subjectAlternativeNames = [
-        each.value.domain,
-        "*.${each.value.domain}"
-      ]
-      validationMethod = "DNS"
-      options = {
-        certificateTransparencyLoggingPreference = "ENABLED"
-      }
-      exportTo = {
-        namespace = var.environment.namespace
-        name      = local.acm_cert_secret_names[each.key]
-        key       = "tls.crt"
-      }
-    }
-  }
+  additional_base_resources = merge(local.ack_acm_resources, local.dns01_certificate_resources)
 }
 
 # Pre-create empty TLS secrets for ACK ACM certificate export
@@ -231,39 +249,6 @@ resource "kubernetes_secret_v1" "acm_cert" {
   }
 }
 
-# --- DNS-01 wildcard certificate resources ---
-# cert-manager Certificate CRDs for DNS-01 wildcard domains.
-# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
-# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
-module "dns01_certificate" {
-  for_each = local.all_dns01_domains
-
-  source          = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
-  name            = "${local.name}-dns01-cert-${each.key}"
-  namespace       = var.environment.namespace
-  advanced_config = {}
-
-  data = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "${local.name}-dns01-cert-${each.key}"
-      namespace = var.environment.namespace
-    }
-    spec = {
-      secretName = local.dns01_cert_secret_names[each.key]
-      issuerRef = {
-        name = local.dns01_cluster_issuer
-        kind = "ClusterIssuer"
-      }
-      dnsNames = [
-        each.value.domain,
-        "*.${each.value.domain}"
-      ]
-    }
-  }
-}
-
 # Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret
 # to start. cert-manager will overwrite these once the DNS-01 challenge succeeds.
 resource "tls_private_key" "dns01_bootstrap" {
diff --git a/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf b/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf
index 97cc5c7a..0188ca71 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf
@@ -60,7 +60,7 @@ locals {
   # When DNS-01 is active: disable_base_domain=true (we re-add it ourselves with certificate_reference)
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {
-      domains            = local.modified_domains
+      domains             = local.modified_domains
       disable_base_domain = local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false)
     })
   })
@@ -86,6 +86,30 @@ locals {
   azure_annotations = {
     "service.beta.kubernetes.io/azure-load-balancer-internal" = lookup(var.instance.spec, "private", false) ? "true" : "false"
   }
+
+  # DNS-01 wildcard certificate resources for cert-manager
+  dns01_certificate_resources = {
+    for domain_key, domain in local.all_dns01_domains :
+    "dns01-cert-${domain_key}" => {
+      apiVersion = "cert-manager.io/v1"
+      kind       = "Certificate"
+      metadata = {
+        name      = "${local.name}-dns01-cert-${domain_key}"
+        namespace = var.environment.namespace
+      }
+      spec = {
+        secretName = local.dns01_cert_secret_names[domain_key]
+        issuerRef = {
+          name = local.dns01_cluster_issuer
+          kind = "ClusterIssuer"
+        }
+        dnsNames = [
+          domain.domain,
+          "*.${domain.domain}"
+        ]
+      }
+    }
+  }
 }
 
 # Call the base utility module
@@ -97,40 +121,8 @@ module "nginx_gateway_fabric" {
   environment   = var.environment
   inputs        = local.merged_inputs
 
-  service_annotations = local.azure_annotations
-}
-
-# --- DNS-01 wildcard certificate resources ---
-# cert-manager Certificate CRDs for DNS-01 wildcard domains.
-# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
-# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
-module "dns01_certificate" {
-  for_each = local.all_dns01_domains
-
-  source          = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
-  name            = "${local.name}-dns01-cert-${each.key}"
-  namespace       = var.environment.namespace
-  advanced_config = {}
-
-  data = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "${local.name}-dns01-cert-${each.key}"
-      namespace = var.environment.namespace
-    }
-    spec = {
-      secretName = local.dns01_cert_secret_names[each.key]
-      issuerRef = {
-        name = local.dns01_cluster_issuer
-        kind = "ClusterIssuer"
-      }
-      dnsNames = [
-        each.value.domain,
-        "*.${each.value.domain}"
-      ]
-    }
-  }
+  service_annotations       = local.azure_annotations
+  additional_base_resources = local.dns01_certificate_resources
 }
 
 # Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret
diff --git a/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf b/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf
index 42567d39..0f320a68 100644
--- a/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf
+++ b/modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf
@@ -60,7 +60,7 @@ locals {
   # When DNS-01 is active: disable_base_domain=true (we re-add it ourselves with certificate_reference)
   modified_instance = merge(var.instance, {
     spec = merge(var.instance.spec, {
-      domains            = local.modified_domains
+      domains             = local.modified_domains
       disable_base_domain = local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false)
     })
   })
@@ -88,6 +88,30 @@ locals {
     "networking.gke.io/load-balancer-type"                         = "Internal"
     "networking.gke.io/internal-load-balancer-allow-global-access" = "true"
   } : {}
+
+  # DNS-01 wildcard certificate resources for cert-manager
+  dns01_certificate_resources = {
+    for domain_key, domain in local.all_dns01_domains :
+    "dns01-cert-${domain_key}" => {
+      apiVersion = "cert-manager.io/v1"
+      kind       = "Certificate"
+      metadata = {
+        name      = "${local.name}-dns01-cert-${domain_key}"
+        namespace = var.environment.namespace
+      }
+      spec = {
+        secretName = local.dns01_cert_secret_names[domain_key]
+        issuerRef = {
+          name = local.dns01_cluster_issuer
+          kind = "ClusterIssuer"
+        }
+        dnsNames = [
+          domain.domain,
+          "*.${domain.domain}"
+        ]
+      }
+    }
+  }
 }
 
 # Call the base utility module
@@ -99,40 +123,8 @@ module "nginx_gateway_fabric" {
   environment   = var.environment
   inputs        = local.merged_inputs
 
-  service_annotations = local.gcp_annotations
-}
-
-# --- DNS-01 wildcard certificate resources ---
-# cert-manager Certificate CRDs for DNS-01 wildcard domains.
-# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
-# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
-module "dns01_certificate" {
-  for_each = local.all_dns01_domains
-
-  source          = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
-  name            = "${local.name}-dns01-cert-${each.key}"
-  namespace       = var.environment.namespace
-  advanced_config = {}
-
-  data = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "${local.name}-dns01-cert-${each.key}"
-      namespace = var.environment.namespace
-    }
-    spec = {
-      secretName = local.dns01_cert_secret_names[each.key]
-      issuerRef = {
-        name = local.dns01_cluster_issuer
-        kind = "ClusterIssuer"
-      }
-      dnsNames = [
-        each.value.domain,
-        "*.${each.value.domain}"
-      ]
-    }
-  }
+  service_annotations       = local.gcp_annotations
+  additional_base_resources = local.dns01_certificate_resources
 }
 
 # Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret