You'd usually put a reverse proxy exposing the services and terminating TLS with the wildcard cert. The individual services can still have individual non-wildc

You'd usually put a reverse proxy exposing the services and terminating TLS with the wildcard cert. The individual services can still have individual non-wildcard internal-only certs signed by an internal CA. These don't need to touch an external CA or appear in CT logs - only the reverse proxy/proxies should ever hit these, and can be configured to trust the internal CA (only) explicitly.