diff --git a/internal/reconcile/reconciler.go b/internal/reconcile/reconciler.go
index 9653447..5647e1a 100644
--- a/internal/reconcile/reconciler.go
+++ b/internal/reconcile/reconciler.go
@@ -431,19 +431,21 @@ func (r *Reconciler) ensureTLSCerts(globalCfg *config.State, doms []domains.Doma
 		gatewayDomain = parts[1]
 	}
 
-	// Collect unique missing certs (wildcard or individual)
+	// Collect unique missing certs. Use hasCertForDomain which checks
+	// both individual certs AND wildcard coverage (e.g., *.civilsociety.dev
+	// covers git.civilsociety.dev — no individual cert needed).
 	missing := map[string]bool{}
 	for _, dom := range doms {
 		if dom.TLS != domains.TLSTerminate || dom.DomainName == "" {
 			continue
 		}
-		if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) {
-			if _, err := os.Stat(certbot.HAProxyCertPath(gatewayDomain)); err != nil {
-				missing["*."+gatewayDomain] = true
-			}
+		if hasCertForDomain(dom.DomainName) {
 			continue
 		}
-		if _, err := os.Stat(certbot.HAProxyCertPath(dom.DomainName)); err != nil {
+		// Determine what cert to provision: wildcard for gateway subdomains, individual otherwise
+		if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) {
+			missing["*."+gatewayDomain] = true
+		} else {
 			missing[dom.DomainName] = true
 		}
 	}