diff --git a/content/docs/configuration/acme/dns01/digitalocean.md b/content/docs/configuration/acme/dns01/digitalocean.md
index 4d6c155863c..e4cea1458fb 100644
--- a/content/docs/configuration/acme/dns01/digitalocean.md
+++ b/content/docs/configuration/acme/dns01/digitalocean.md
@@ -12,23 +12,21 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: digitalocean-dns
-data:
+type: Opaque
+stringData:
   # insert your DO access token here
-  access-token: "base64 encoded access-token here"
-  ```
+  access-token: "your-access-token"
+```
 
 The access token must have write access.
 
+Using `stringData` lets you provide the token in plain text; Kubernetes
+base64-encodes it for you when the `Secret` is created.
+
 To create a Personal Access Token, see [DigitalOcean documentation](https://docs.digitalocean.com/reference/api/create-personal-access-token/).
 
 Handy direct link: https://cloud.digitalocean.com/account/api/tokens/new
 
-To encode your access token into base64, you can use the following
-
-```bash
-echo -n 'your-access-token' | base64
-```
-
 ```yaml
 apiVersion: cert-manager.io/v1
 kind: Issuer