diff --git a/third_party/cert-manager-latest/net-certmanager.yaml b/third_party/cert-manager-latest/net-certmanager.yaml
index 298b42f7a5d0..5efa967db8ad 100644
--- a/third_party/cert-manager-latest/net-certmanager.yaml
+++ b/third_party/cert-manager-latest/net-certmanager.yaml
@@ -19,7 +19,7 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
@@ -52,7 +52,7 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
@@ -93,7 +93,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 
@@ -119,7 +119,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 data:
@@ -178,7 +178,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -190,7 +190,7 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230912-c6be2211"
+        app.kubernetes.io/version: "20230914-961a089d"
         app.kubernetes.io/name: knative-serving
     spec:
       serviceAccountName: controller
@@ -198,7 +198,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:f9c4a677b476d3126a213c8c75893f9a62d0c83bd51c9452a62982d28227d69b
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:a687e7c0dd0031e91b1fd38b821833c626ee6b6bb3dfabc6ff511d72634f1842
           resources:
             requests:
               cpu: 30m
@@ -225,6 +225,8 @@ spec:
             capabilities:
               drop:
                 - ALL
+            seccompProfile:
+              type: RuntimeDefault
           ports:
             - name: metrics
               containerPort: 9090
@@ -237,7 +239,7 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
@@ -275,7 +277,7 @@ metadata:
   name: selfsigned-cluster-issuer
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -287,7 +289,7 @@ metadata:
   name: knative-internal-encryption-issuer
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -301,7 +303,7 @@ metadata:
   namespace: cert-manager #  If you want to use it as a ClusterIssuer the secret must be in the cert-manager namespace.
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -336,7 +338,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -349,7 +351,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "20230912-c6be2211"
+        app.kubernetes.io/version: "20230914-961a089d"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
     spec:
@@ -358,7 +360,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:e0064491cb254b145356f436b4844b6dad9ba635baed0c6b939e8e9ad2836502
+          image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:de0efa341e5bb3560257a1c940dfbcb0cdde56cfa28aa13a471869bbee9b3464
           resources:
             requests:
               cpu: 20m
@@ -391,6 +393,8 @@ spec:
             capabilities:
               drop:
                 - ALL
+            seccompProfile:
+              type: RuntimeDefault
           ports:
             - name: metrics
               containerPort: 9090
@@ -422,7 +426,7 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "20230912-c6be2211"
+    app.kubernetes.io/version: "20230914-961a089d"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec: