diff --git a/site/content/en/latest/user/tls-cert-manager.md b/site/content/en/latest/user/tls-cert-manager.md
index 2fe8112f1b5..0cc9d59c3af 100644
--- a/site/content/en/latest/user/tls-cert-manager.md
+++ b/site/content/en/latest/user/tls-cert-manager.md
@@ -182,6 +182,7 @@ spec:
           - kind: Gateway
             name: eg
             namespace: default
+EOF
 ```
 
 The important parts are
@@ -209,7 +210,7 @@ Status:
 Now we're ready to update the Gateway annotation to use this issuer instead:
 
 ```console
-$ kubectl annotate --overwrite gateway/eg cert-manager.io/clusterissuer=letsencrypt-staging
+$ kubectl annotate --overwrite gateway/eg cert-manager.io/cluster-issuer=letsencrypt-staging
 ```
 
 The Gateway should be picked up by cert-manager, which will create a new certificate for you, and replace the Secret.
@@ -262,12 +263,13 @@ spec:
           - kind: Gateway
             name: eg
             namespace: default
+EOF
 ```
 
 And now you can update the Gateway listener to point to `letsencrypt` instead:
 
 ```console
-$ kubectl annotate --overwrite gateway/eg cert-manager.io/clusterissuer=letsencrypt
+$ kubectl annotate --overwrite gateway/eg cert-manager.io/cluster-issuer=letsencrypt
 ```
 
 As before, track it by looking at CertificateRequests.
diff --git a/site/content/en/v0.6.0/user/tls-cert-manager.md b/site/content/en/v0.6.0/user/tls-cert-manager.md
index bbc291d39d9..ae45758fda7 100644
--- a/site/content/en/v0.6.0/user/tls-cert-manager.md
+++ b/site/content/en/v0.6.0/user/tls-cert-manager.md
@@ -182,6 +182,7 @@ spec:
           - kind: Gateway
             name: eg
             namespace: default
+EOF
 ```
 
 The important parts are
@@ -209,7 +210,7 @@ Status:
 Now we're ready to update the Gateway annotation to use this issuer instead:
 
 ```console
-$ kubectl annotate --overwrite gateway/eg cert-manager.io/clusterissuer=letsencrypt-staging
+$ kubectl annotate --overwrite gateway/eg cert-manager.io/cluster-issuer=letsencrypt-staging
 ```
 
 The Gateway should be picked up by cert-manager, which will create a new certificate for you, and replace the Secret.
@@ -262,12 +263,13 @@ spec:
           - kind: Gateway
             name: eg
             namespace: default
+EOF
 ```
 
 And now you can update the Gateway listener to point to `letsencrypt` instead:
 
 ```console
-$ kubectl annotate --overwrite gateway/eg cert-manager.io/clusterissuer=letsencrypt
+$ kubectl annotate --overwrite gateway/eg cert-manager.io/cluster-issuer=letsencrypt
 ```
 
 As before, track it by looking at CertificateRequests.