cert-manager renewed our certificate and the pods kept serving the old one

At ten past nine on a Thursday in May every partner calling our inbound order gateway started failing...