@@ -295,3 +295,60 @@ func TestReflectionCoverageHonorsCompleteNamespaceSecretGrants(t *testing.T) {
 		}
 	}
 }
+
+func TestDelegatedContourCertificateIsNotOrphan(t *testing.T) {
+	wildcard := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "wildcard", Namespace: "certs"}}
+	unused := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "unused", Namespace: "certs"}}
+	client := fake.NewClientset(wildcard, unused)
+	scopes := map[string]k8score.ResourceScope{}
+	for _, kind := range append(append([]string{}, typedConfigConsumers...), "secrets", "configmaps") {
+		scopes[kind] = k8score.ResourceScope{Enabled: true}
+	}
+	if err := k8s.InitScopedTestResourceCache(client, scopes); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(k8s.ResetTestState)
+
+	proxyGVR := schema.GroupVersionResource{Group: "projectcontour.io", Version: "v1", Resource: "httpproxies"}
+	proxy := testUnstructured("projectcontour.io/v1", "HTTPProxy", "shop", "storefront", map[string]any{
+		"spec": map[string]any{"virtualhost": map[string]any{
+			"fqdn": "shop.example.com",
+			"tls":  map[string]any{"secretName": "certs/wildcard"},
+		}},
+	})
+	dyn := dynamicfake.NewSimpleDynamicClientWithCustomListKinds(runtime.NewScheme(), map[schema.GroupVersionResource]string{proxyGVR: "HTTPProxyList"})
+	if _, err := dyn.Resource(proxyGVR).Namespace("shop").Create(context.Background(), proxy, metav1.CreateOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if err := k8s.InitTestDynamicResourceCache(dyn, []k8s.APIResource{{Group: proxyGVR.Group, Version: proxyGVR.Version, Name: proxyGVR.Resource, Kind: "HTTPProxy", Namespaced: true, Verbs: []string{"list", "watch"}}}); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(k8s.ResetTestDynamicState)
+	dynamic := k8s.GetDynamicResourceCache()
+	if err := dynamic.EnsureWatching(proxyGVR); err != nil {
+		t.Fatal(err)
+	}
+	if !dynamic.WaitForSync(proxyGVR, 2*time.Second) {
+		t.Fatal("sync timeout")
+	}
+	cache := k8s.GetResourceCache()
+	orphans := func(results *bp.ScanResults) map[string]bool {
+		seen := map[string]bool{}
+		for _, f := range results.Findings {
+			if f.CheckID == "orphanConfigMapSecret" && f.Kind == "Secret" {
+				seen[f.Name] = true
+			}
+		}
+		return seen
+	}
+
+	// Auditing only the certificate's namespace still sees the proxy in "shop".
+	if seen := orphans(RunFromCache(cache, []string{"certs"}, nil)); !seen["unused"] || seen["wildcard"] {
+		t.Fatalf("unrestricted audit of certs: orphans %v, want only unused", seen)
+	}
+	// Without read access to other namespaces' proxies, absence can't be proven.
+	limited := &ReadScope{Namespaces: []string{"certs"}, SecretNamespaces: []string{"certs"}}
+	if seen := orphans(RunFromCache(cache, []string{"certs"}, &RunOptions{Scope: limited})); len(seen) != 0 {
+		t.Fatalf("restricted audit claimed orphans it cannot prove: %v", seen)
+	}
+}
@@ -5,6 +5,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/skyhook-io/radar/pkg/configrefs"
 	"github.com/skyhook-io/radar/pkg/resourceid"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -141,7 +142,7 @@ var configRefDependencies = map[schema.GroupResource]configRefDependency{
 	{Group: "traefik.containo.us", Resource: "tlsoptions"}:                    {traefikTLSOptionConfigRefs, false, false},
 	{Group: "traefik.io", Resource: "tlsstores"}:                              {traefikTLSStoreConfigRefs, false, false},
 	{Group: "traefik.containo.us", Resource: "tlsstores"}:                     {traefikTLSStoreConfigRefs, false, false},
-	{Group: "projectcontour.io", Resource: "httpproxies"}:                     {contourHTTPProxyConfigRefs, false, false},
+	{Group: "projectcontour.io", Resource: "httpproxies"}:                     {contourHTTPProxyConfigRefs, false, true},
 	{Group: "networking.istio.io", Resource: "gateways"}:                      {istioGatewayConfigRefs, false, false},
 	{Group: "cert-manager.io", Resource: "certificates"}:                      {certManagerCertificateConfigRefs, false, false},
 	{Group: "cert-manager.io", Resource: "issuers"}:                           {certManagerIssuerConfigRefs, false, false},
@@ -243,7 +244,26 @@ func traefikTLSStoreConfigRefs(u *unstructured.Unstructured) []bp.ConfigObjectRe
 
 func contourHTTPProxyConfigRefs(u *unstructured.Unstructured) []bp.ConfigObjectRef {
 	var refs []bp.ConfigObjectRef
-	addSecret(&refs, u.GetNamespace(), stringAt(u.Object, "spec", "virtualhost", "tls", "secretName"))
+	add := func(ref string) {
+		if ref != "" {
+			ns, name := configrefs.ContourSecretRef(u.GetNamespace(), ref)
+			addSecret(&refs, ns, name)
+		}
+	}
+	add(stringAt(u.Object, "spec", "virtualhost", "tls", "secretName"))
+	add(stringAt(u.Object, "spec", "virtualhost", "tls", "clientValidation", "caSecret"))
+	add(stringAt(u.Object, "spec", "virtualhost", "tls", "clientValidation", "crlSecret"))
+	for _, provider := range mapsAt(u.Object, "spec", "virtualhost", "jwtProviders") {
+		add(stringAt(provider, "remoteJWKS", "validation", "caSecret"))
+	}
+	for _, route := range mapsAt(u.Object, "spec", "routes") {
+		for _, service := range mapsAt(route, "services") {
+			add(stringAt(service, "validation", "caSecret"))
+		}
+	}
+	for _, service := range mapsAt(u.Object, "spec", "tcpproxy", "services") {
+		add(stringAt(service, "validation", "caSecret"))
+	}
 	return refs
 }
 
 
@@ -68,6 +68,34 @@ func TestDynamicConfigObjectRefs(t *testing.T) {
 			obj:  map[string]any{"spec": map[string]any{"virtualhost": map[string]any{"tls": map[string]any{"secretName": "contour-cert"}}}},
 			want: refs(secret("edge", "contour-cert")),
 		},
+		{
+			name: "contour httpproxy delegated tls",
+			gvr:  gvr("projectcontour.io", "v1", "httpproxies"),
+			ns:   "edge",
+			obj:  map[string]any{"spec": map[string]any{"virtualhost": map[string]any{"tls": map[string]any{"secretName": "certs/wildcard"}}}},
+			want: refs(secret("certs", "wildcard")),
+		},
+		{
+			name: "contour httpproxy validation secrets",
+			gvr:  gvr("projectcontour.io", "v1", "httpproxies"),
+			ns:   "edge",
+			obj: map[string]any{"spec": map[string]any{
+				"virtualhost": map[string]any{
+					"tls": map[string]any{
+						"secretName":       "serving",
+						"clientValidation": map[string]any{"caSecret": "client-ca", "crlSecret": "pki/client-crl"},
+					},
+					"jwtProviders": []any{map[string]any{"remoteJWKS": map[string]any{"validation": map[string]any{"caSecret": "jwks-ca"}}}},
+				},
+				"routes": []any{map[string]any{"services": []any{
+					map[string]any{"name": "api", "validation": map[string]any{"caSecret": "pki/upstream-ca"}},
+				}}},
+				"tcpproxy": map[string]any{"services": []any{
+					map[string]any{"name": "db", "validation": map[string]any{"caSecret": "db-ca"}},
+				}},
+			}},
+			want: refs(secret("edge", "serving"), secret("edge", "client-ca"), secret("pki", "client-crl"), secret("edge", "jwks-ca"), secret("pki", "upstream-ca"), secret("edge", "db-ca")),
+		},
 		{
 			name: "istio gateway tls credentials",
 			gvr:  gvr("networking.istio.io", "v1", "gateways"),
@@ -371,6 +399,41 @@ func TestListDynamicConfigObjectRefsFiltersByTargetNamespace(t *testing.T) {
 	assertRefSet(t, got, refs(secret("infra", "shared-cert")))
 }
 
+func TestListDynamicConfigObjectRefsFindsDelegatedContourSecret(t *testing.T) {
+	proxyGVR := gvr("projectcontour.io", "v1", "httpproxies")
+	proxy := testUnstructured("projectcontour.io/v1", "HTTPProxy", "shop", "storefront", map[string]any{
+		"spec": map[string]any{"virtualhost": map[string]any{
+			"fqdn": "shop.example.com",
+			"tls":  map[string]any{"secretName": "certs/wildcard"},
+		}},
+	})
+	dynClient := dynamicfake.NewSimpleDynamicClientWithCustomListKinds(
+		runtime.NewScheme(),
+		map[schema.GroupVersionResource]string{proxyGVR: "HTTPProxyList"},
+	)
+	if _, err := dynClient.Resource(proxyGVR).Namespace("shop").Create(context.Background(), proxy, metav1.CreateOptions{}); err != nil {
+		t.Fatalf("create HTTPProxy fixture: %v", err)
+	}
+	if err := k8s.InitTestDynamicResourceCache(dynClient, []k8s.APIResource{
+		{Group: "projectcontour.io", Version: "v1", Kind: "HTTPProxy", Name: "httpproxies", Namespaced: true, Verbs: []string{"list", "watch"}},
+	}); err != nil {
+		t.Fatalf("InitTestDynamicResourceCache: %v", err)
+	}
+	defer k8s.ResetTestDynamicState()
+
+	dynCache := k8s.GetDynamicResourceCache()
+	if err := dynCache.EnsureWatching(proxyGVR); err != nil {
+		t.Fatalf("EnsureWatching: %v", err)
+	}
+	if !dynCache.WaitForSync(proxyGVR, 2*time.Second) {
+		t.Fatal("dynamic HTTPProxy cache did not sync")
+	}
+
+	// Auditing only the delegating namespace must still see the proxy that uses its Secret.
+	got := listDynamicConfigObjectRefs([]string{"certs"}, dynamicConfigRefOptions{})
+	assertRefSet(t, got, refs(secret("certs", "wildcard")))
+}
+
 func TestListDynamicConfigObjectRefsAddsServiceAccountImagePullSecretsForPodTemplates(t *testing.T) {
 	rolloutGVR := gvr("argoproj.io", "v1alpha1", "rollouts")
 	rollout := testUnstructured("argoproj.io/v1alpha1", "Rollout", "app", "web", map[string]any{
 
@@ -5,6 +5,7 @@ import {
   getHTTPProxyRouteCount,
   getHTTPProxyServiceCount,
   getHTTPProxyStatus,
+  getHTTPProxyTLSSecret,
   hasHTTPProxyTLS,
 } from '../resource-utils-contour'
 
@@ -19,6 +20,7 @@ export function ContourHTTPProxyRenderer({ data, onNavigate }: ContourHTTPProxyR
   const routes = spec.routes || []
   const includes = spec.includes || []
   const tls = spec.virtualhost?.tls
+  const tlsSecret = getHTTPProxyTLSSecret(data)
   const tcpproxy = spec.tcpproxy
   const ns = data.metadata?.namespace || ''
   const conditions = status.conditions
@@ -174,12 +176,13 @@ export function ContourHTTPProxyRenderer({ data, onNavigate }: ContourHTTPProxyR
       {tls && (
         <Section title="TLS" icon={Lock} defaultExpanded>
           <PropertyList>
-            {tls.secretName && (
+            {tlsSecret && (
               <Property label="Secret" value={
                 <ResourceLink
-                  name={tls.secretName}
+                  name={tlsSecret.name}
                   kind="secrets"
-                  namespace={ns}
+                  namespace={tlsSecret.namespace}
+                  label={tlsSecret.namespace !== ns ? `${tlsSecret.namespace}/${tlsSecret.name}` : undefined}
                   onNavigate={onNavigate}
                 />
               } />
 
@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest'
+import { getHTTPProxyTLSSecret } from './resource-utils-contour'
+
+const proxy = (secretName?: string) => ({
+  metadata: { namespace: 'shop' },
+  spec: { virtualhost: { fqdn: 'shop.example.com', tls: secretName === undefined ? {} : { secretName } } },
+})
+
+describe('getHTTPProxyTLSSecret', () => {
+  it('resolves a bare name in the proxy namespace', () => {
+    expect(getHTTPProxyTLSSecret(proxy('cert'))).toEqual({ namespace: 'shop', name: 'cert' })
+  })
+  it('resolves a delegated namespace/name', () => {
+    expect(getHTTPProxyTLSSecret(proxy('certs/wildcard'))).toEqual({ namespace: 'certs', name: 'wildcard' })
+  })
+  it('defaults an empty namespace to the proxy namespace', () => {
+    expect(getHTTPProxyTLSSecret(proxy('/cert'))).toEqual({ namespace: 'shop', name: 'cert' })
+  })
+  it('splits only at the first slash', () => {
+    expect(getHTTPProxyTLSSecret(proxy('certs/a/b'))).toEqual({ namespace: 'certs', name: 'a/b' })
+  })
+  it('returns null without a secret', () => {
+    expect(getHTTPProxyTLSSecret(proxy())).toBeNull()
+  })
+})
@@ -32,3 +32,15 @@ export function getHTTPProxyIncludeCount(resource: any): number {
 export function hasHTTPProxyTLS(resource: any): boolean {
   return !!resource.spec?.virtualhost?.tls
 }
+
+// Contour reads tls.secretName as "namespace/name" when another namespace
+// delegates the Secret with a TLSCertificateDelegation; a bare name, or an
+// empty namespace, is in the proxy's own namespace.
+export function getHTTPProxyTLSSecret(resource: any): { namespace: string; name: string } | null {
+  const ref: string | undefined = resource.spec?.virtualhost?.tls?.secretName
+  if (!ref) return null
+  const ownNamespace = resource.metadata?.namespace ?? ''
+  const slash = ref.indexOf('/')
+  if (slash < 0) return { namespace: ownNamespace, name: ref }
+  return { namespace: ref.slice(0, slash) || ownNamespace, name: ref.slice(slash + 1) }
+}
@@ -0,0 +1,18 @@
+package configrefs
+
+import "strings"
+
+// ContourSecretRef resolves a Secret reference in an HTTPProxy, such as
+// spec.virtualhost.tls.secretName, the way Contour does. "namespace/name"
+// names a Secret another namespace delegates with a TLSCertificateDelegation;
+// a bare name, or an empty namespace, is in the proxy's own namespace.
+func ContourSecretRef(proxyNamespace, ref string) (namespace, name string) {
+	namespace, name, found := strings.Cut(ref, "/")
+	if !found {
+		return proxyNamespace, ref
+	}
+	if namespace == "" {
+		namespace = proxyNamespace
+	}
+	return namespace, name
+}
@@ -0,0 +1,17 @@
+package configrefs
+
+import "testing"
+
+func TestContourSecretRef(t *testing.T) {
+	for _, tt := range []struct{ ref, wantNs, wantName string }{
+		{ref: "cert", wantNs: "edge", wantName: "cert"},
+		{ref: "certs/wildcard", wantNs: "certs", wantName: "wildcard"},
+		{ref: "/cert", wantNs: "edge", wantName: "cert"},
+		{ref: "certs/a/b", wantNs: "certs", wantName: "a/b"},
+	} {
+		ns, name := ContourSecretRef("edge", tt.ref)
+		if ns != tt.wantNs || name != tt.wantName {
+			t.Errorf("ContourSecretRef(edge, %q) = %s/%s, want %s/%s", tt.ref, ns, name, tt.wantNs, tt.wantName)
+		}
+	}
+}
@@ -5719,9 +5719,11 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 		}
 
 		// HTTPProxy → Secret edges (via spec.virtualhost.tls.secretName)
-		tlsSecretName, _, _ := unstructured.NestedString(res.Object, "spec", "virtualhost", "tls", "secretName")
-		if tlsSecretName != "" {
-			secretNodeID := fmt.Sprintf("secret/%s/%s", resNs, tlsSecretName)
+		tlsSecretRef, _, _ := unstructured.NestedString(res.Object, "spec", "virtualhost", "tls", "secretName")
+		secretNs, tlsSecretName := configrefs.ContourSecretRef(resNs, tlsSecretRef)
+		// A delegated certificate lives in another namespace, which a filtered view may exclude.
+		if tlsSecretName != "" && opts.MatchesNamespaceFilter(secretNs) {
+			secretNodeID := fmt.Sprintf("secret/%s/%s", secretNs, tlsSecretName)
 			// Create stub Secret node if it doesn't already exist (same pattern as Traefik)
 			if !existingSecretNodes[secretNodeID] {
 				existingSecretNodes[secretNodeID] = true
@@ -5731,7 +5733,7 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 					Name:   tlsSecretName,
 					Status: StatusUnknown,
 					Data: map[string]any{
-						"namespace": resNs,
+						"namespace": secretNs,
 						"labels":    map[string]string{},
 					},
 				})
@@ -5747,7 +5749,7 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 				})
 			}
 			// Also check for cert-manager Certificate edge
-			certID := certBySecret[resNs+"/"+tlsSecretName]
+			certID := certBySecret[secretNs+"/"+tlsSecretName]
 			if certID != "" {
 				dedupeKey2 := resID + "|" + certID
 				if !contourEdgeSeen[dedupeKey2] {