diff --git a/third_party/cert-manager-0.12.0/net-certmanager.yaml b/third_party/cert-manager-0.12.0/net-certmanager.yaml
index bfc81a309d68..b54bf46b5ee7 100644
--- a/third_party/cert-manager-0.12.0/net-certmanager.yaml
+++ b/third_party/cert-manager-0.12.0/net-certmanager.yaml
@@ -18,7 +18,7 @@ metadata:
   # These are the permissions needed by the `cert-manager` `Certificate` implementation.
   name: knative-serving-certmanager
   labels:
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
 rules:
@@ -49,7 +49,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
 webhooks:
 - admissionReviewVersions:
   - v1beta1
@@ -86,7 +86,7 @@ metadata:
   name: net-certmanager-webhook-certs
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
 
 ---
 # Copyright 2020 The Knative Authors
@@ -109,7 +109,7 @@ metadata:
   name: config-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
     networking.knative.dev/certificate-provider: cert-manager
 data:
   _example: |
@@ -156,7 +156,7 @@ metadata:
   name: networking-certmanager
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
     networking.knative.dev/certificate-provider: cert-manager
 spec:
   selector:
@@ -168,14 +168,14 @@ spec:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
       labels:
         app: networking-certmanager
-        serving.knative.dev/release: "v20200921-3686f77"
+        serving.knative.dev/release: "v20200923-3970ad9"
     spec:
       serviceAccountName: controller
       containers:
       - name: networking-certmanager
         # This is the Go import path for the binary that is containerized
         # and substituted here.
-        image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:905f61a5414be0c61d83870a124cec55c77189524053130bd5de9261f1631af4
+        image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller@sha256:60fb930b61ea4c373b1e18ff044e5fcd370b3d779cfd924795f339c1b900656f
         resources:
           requests:
             cpu: 30m
@@ -208,7 +208,7 @@ kind: Service
 metadata:
   labels:
     app: networking-certmanager
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
     networking.knative.dev/certificate-provider: cert-manager
   name: networking-certmanager
   namespace: knative-serving
@@ -245,7 +245,7 @@ metadata:
   name: net-certmanager-webhook
   namespace: knative-serving
   labels:
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
 spec:
   selector:
     matchLabels:
@@ -258,14 +258,14 @@ spec:
       labels:
         app: net-certmanager-webhook
         role: net-certmanager-webhook
-        serving.knative.dev/release: "v20200921-3686f77"
+        serving.knative.dev/release: "v20200923-3970ad9"
     spec:
       serviceAccountName: controller
       containers:
       - name: webhook
         # This is the Go import path for the binary that is containerized
         # and substituted here.
-        image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:12c79020427bfc6ae02fc62fcd2b2625ebe750efde636641deefe96d20c14f50
+        image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/webhook@sha256:c24f87d2664d443537c15b1ff0db86d5b38d7331fd37e16b509b27983c505685
         resources:
           requests:
             cpu: 20m
@@ -319,7 +319,7 @@ metadata:
   namespace: knative-serving
   labels:
     role: net-certmanager-webhook
-    serving.knative.dev/release: "v20200921-3686f77"
+    serving.knative.dev/release: "v20200923-3970ad9"
 spec:
   ports:
   - # Define metrics and profiling for them to be accessible within service meshes.