diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 31471c3220a6..0d1d7a5a1509 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 3cc8e7c3a8db6a4b2f70bed69609d4575d518b46
+# Generated when HEAD was c445efe838ca69f4314882555dca42b895350041
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -54,7 +54,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -93,7 +93,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -114,7 +114,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -152,7 +152,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 data:
   # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
@@ -262,7 +262,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -280,7 +280,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -313,7 +313,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -330,14 +330,14 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20240620-3cc8e7c3"
+        app.kubernetes.io/version: "20240625-c445efe8"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:880f5d8734adbd95613d7ded7c7cfc5d5efa3284cf7155f31bbd25f8f689138d
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:03fe070116577df4295ed7c3e9a835ed49e75a1b680ecfa3a46c46395df69946
           resources:
             requests:
               cpu: 30m
@@ -416,7 +416,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -430,14 +430,14 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20240620-3cc8e7c3"
+        app.kubernetes.io/version: "20240625-c445efe8"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:b05bb0e5761979a75c77579faf0b02acc60b2926514f1b8043d179b0f945e205
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:227a75e442929a59521213dafdb8a0d8510478f52f1d88fd8ff0dc21f4013633
           resources:
             requests:
               cpu: 20m
@@ -515,7 +515,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -542,7 +542,7 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -581,7 +581,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -620,7 +620,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -661,7 +661,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240620-3cc8e7c3"
+    app.kubernetes.io/version: "20240625-c445efe8"
     networking.knative.dev/ingress-provider: istio
     networking.knative.dev/certificate-type: system-internal
     knative.dev/install-knative-certificate: "true"