diff --git a/bindata/cert-manager-deployment/cert-manager-namespace.yaml b/bindata/cert-manager-deployment/cert-manager-namespace.yaml
index 26e94d330..0a774195b 100644
--- a/bindata/cert-manager-deployment/cert-manager-namespace.yaml
+++ b/bindata/cert-manager-deployment/cert-manager-namespace.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
+  labels:
     openshift.io/cluster-monitoring: "true"
   name: cert-manager
diff --git a/pkg/controller/certmanager/namespace_manifest_test.go b/pkg/controller/certmanager/namespace_manifest_test.go
new file mode 100644
index 000000000..593fa1f07
--- /dev/null
+++ b/pkg/controller/certmanager/namespace_manifest_test.go
@@ -0,0 +1,21 @@
+package certmanager
+
+import (
+	"testing"
+
+	"github.com/openshift/library-go/pkg/operator/resource/resourceread"
+	"github.com/stretchr/testify/require"
+
+	"github.com/openshift/cert-manager-operator/pkg/operator/assets"
+)
+
+func TestNamespaceManifestHasClusterMonitoringLabel(t *testing.T) {
+	manifestBytes, err := assets.Asset("cert-manager-deployment/cert-manager-namespace.yaml")
+	require.NoError(t, err, "failed to load namespace asset")
+
+	ns := resourceread.ReadNamespaceV1OrDie(manifestBytes)
+
+	require.Equal(t, "cert-manager", ns.Name)
+	require.Equal(t, "true", ns.Labels["openshift.io/cluster-monitoring"],
+		"openshift.io/cluster-monitoring must be a label (not annotation) for Prometheus namespace discovery")
+}
diff --git a/pkg/operator/assets/bindata.go b/pkg/operator/assets/bindata.go
index 6183e9b47..a1b1d4716 100644
--- a/pkg/operator/assets/bindata.go
+++ b/pkg/operator/assets/bindata.go
@@ -646,7 +646,7 @@ func certManagerDeploymentCertManagerCertManagerControllerCertificatesigningrequ
 var _certManagerDeploymentCertManagerNamespaceYaml = []byte(`apiVersion: v1
 kind: Namespace
 metadata:
-  annotations:
+  labels:
     openshift.io/cluster-monitoring: "true"
   name: cert-manager
 `)