diff --git a/pkg/certmanager/cache_store.go b/pkg/certmanager/cache_store.go
index 1dfa0d1a0..e9c55678f 100644
--- a/pkg/certmanager/cache_store.go
+++ b/pkg/certmanager/cache_store.go
@@ -95,8 +95,7 @@ func (w *CacheStore) WarmCache(ctx context.Context) error {
 
 func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *coredata.CustomDomain) error {
 	var loadedDomain coredata.CustomDomain
-	scope := coredata.NewScope(domain.OrganizationID.TenantID())
-	if err := loadedDomain.LoadByID(ctx, conn, scope, w.encryptionKey, domain.ID); err != nil {
+	if err := loadedDomain.LoadByID(ctx, conn, coredata.NewNoScope(), w.encryptionKey, domain.ID); err != nil {
 		return fmt.Errorf("cannot load domain with decrypted values: %w", err)
 	}
 
diff --git a/pkg/certmanager/provisioner.go b/pkg/certmanager/provisioner.go
index 8329d7528..f2f06542b 100644
--- a/pkg/certmanager/provisioner.go
+++ b/pkg/certmanager/provisioner.go
@@ -130,10 +130,8 @@ func (p *Provisioner) provisionDomainCertificate(
 			return err
 		}
 
-		// Update domain with challenge details and set to PROVISIONING
-		scope := coredata.NewScope(domain.OrganizationID.TenantID())
 		fullDomain := &coredata.CustomDomain{}
-		if err := fullDomain.LoadByIDForUpdate(ctx, conn, scope, p.encryptionKey, domain.ID); err != nil {
+		if err := fullDomain.LoadByIDForUpdate(ctx, conn, coredata.NewNoScope(), p.encryptionKey, domain.ID); err != nil {
 			return fmt.Errorf("cannot load domain for update: %w", err)
 		}
 
@@ -143,7 +141,7 @@ func (p *Provisioner) provisionDomainCertificate(
 		fullDomain.HTTPOrderURL = &challenge.OrderURL
 		fullDomain.SSLStatus = coredata.CustomDomainSSLStatusProvisioning
 
-		if err := fullDomain.Update(ctx, conn, scope, p.encryptionKey); err != nil {
+		if err := fullDomain.Update(ctx, conn, coredata.NewNoScope(), p.encryptionKey); err != nil {
 			return fmt.Errorf("failed to update domain with challenge: %w", err)
 		}
 
@@ -157,7 +155,6 @@ func (p *Provisioner) provisionDomainCertificate(
 		return nil
 	}
 
-	// Domain already has challenge details, complete it
 	challenge := &HTTPChallenge{
 		Domain:   domain.Domain,
 		Token:    *domain.HTTPChallengeToken,
@@ -185,9 +182,8 @@ func (p *Provisioner) provisionDomainCertificate(
 		log.Time("expires_at", cert.ExpiresAt),
 	)
 
-	scope := coredata.NewScope(domain.OrganizationID.TenantID())
 	fullDomain := &coredata.CustomDomain{}
-	if err := fullDomain.LoadByID(ctx, conn, scope, p.encryptionKey, domain.ID); err != nil {
+	if err := fullDomain.LoadByID(ctx, conn, coredata.NewNoScope(), p.encryptionKey, domain.ID); err != nil {
 		return fmt.Errorf("cannot load domain: %w", err)
 	}
 
@@ -203,7 +199,7 @@ func (p *Provisioner) provisionDomainCertificate(
 	fullDomain.HTTPChallengeURL = nil
 	fullDomain.HTTPOrderURL = nil
 
-	if err := fullDomain.Update(ctx, conn, scope, p.encryptionKey); err != nil {
+	if err := fullDomain.Update(ctx, conn, coredata.NewNoScope(), p.encryptionKey); err != nil {
 		return fmt.Errorf("cannot update domain: %w", err)
 	}
 
diff --git a/pkg/certmanager/renewer.go b/pkg/certmanager/renewer.go
index da334fe25..8296608b5 100644
--- a/pkg/certmanager/renewer.go
+++ b/pkg/certmanager/renewer.go
@@ -128,10 +128,8 @@ func (r *Renewer) checkAndRenew(ctx context.Context) error {
 }
 
 func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredata.CustomDomain) error {
-	scope := coredata.NewScope(domain.OrganizationID.TenantID())
-
 	lockedDomain := &coredata.CustomDomain{}
-	if err := lockedDomain.LoadByIDForUpdate(ctx, conn, scope, r.encryptionKey, domain.ID); err != nil {
+	if err := lockedDomain.LoadByIDForUpdate(ctx, conn, coredata.NewNoScope(), r.encryptionKey, domain.ID); err != nil {
 		return fmt.Errorf("cannot lock domain for renewal: %w", err)
 	}
 
@@ -166,7 +164,7 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 			lockedDomain.HTTPOrderURL = &challenge.OrderURL
 			lockedDomain.SSLStatus = coredata.CustomDomainSSLStatusRenewing
 
-			if err := lockedDomain.Update(ctx, conn, scope, r.encryptionKey); err != nil {
+			if err := lockedDomain.Update(ctx, conn, coredata.NewNoScope(), r.encryptionKey); err != nil {
 				return fmt.Errorf("cannot update domain with renewal challenge: %w", err)
 			}
 
@@ -195,7 +193,7 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 	lockedDomain.HTTPChallengeURL = nil
 	lockedDomain.HTTPOrderURL = nil
 
-	if err := lockedDomain.Update(ctx, conn, scope, r.encryptionKey); err != nil {
+	if err := lockedDomain.Update(ctx, conn, coredata.NewNoScope(), r.encryptionKey); err != nil {
 		return fmt.Errorf("cannot update domain with renewed certificate: %w", err)
 	}
 
diff --git a/pkg/certmanager/selector.go b/pkg/certmanager/selector.go
index c91913d40..be53a66d7 100644
--- a/pkg/certmanager/selector.go
+++ b/pkg/certmanager/selector.go
@@ -28,9 +28,9 @@ import (
 
 type (
 	Selector struct {
-		pg               *pg.Client
-		cache            sync.Map
-		encryptionKey    cipher.EncryptionKey
+		pg            *pg.Client
+		cache         sync.Map
+		encryptionKey cipher.EncryptionKey
 	}
 )
 
@@ -44,7 +44,6 @@ func NewSelector(
 	}
 }
 
-
 func (s *Selector) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 	domain := hello.ServerName
 
@@ -114,10 +113,6 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
 		return fmt.Errorf("cannot load domain: %w", err)
 	}
 
-	if !customDomain.IsActive {
-		return fmt.Errorf("domain is not active")
-	}
-
 	if customDomain.SSLStatus != coredata.CustomDomainSSLStatusActive {
 		return fmt.Errorf("domain does not have active SSL certificate")
 	}
@@ -153,7 +148,6 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
 	return nil
 }
 
-
 func (s *Selector) ClearCache() {
 	s.cache.Range(
 		func(key, _ any) bool {