diff --git a/third_party/istio-latest/net-istio.yaml b/third_party/istio-latest/net-istio.yaml
index 6d0dc1523b16..f6b558abc1c1 100644
--- a/third_party/istio-latest/net-istio.yaml
+++ b/third_party/istio-latest/net-istio.yaml
@@ -1,4 +1,4 @@
-# Generated when HEAD was 8aa55613d7c5d5089e4103806f828e6be68e9079
+# Generated when HEAD was be4f06e9063d9cd3e5c2f0be068eb9c2a3315ba7
 #
 # Copyright 2019 The Knative Authors
 #
@@ -22,7 +22,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     serving.knative.dev/controller: "true"
     networking.knative.dev/ingress-provider: istio
 rules:
@@ -54,7 +54,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -93,7 +93,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -114,7 +114,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
     experimental.istio.io/disable-gateway-port-translation: "true"
 spec:
@@ -152,7 +152,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 data:
   # TODO(nghia): Extract the .svc.cluster.local suffix into its own config.
@@ -262,7 +262,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -280,7 +280,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -313,7 +313,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -330,14 +330,14 @@ spec:
         app: net-istio-controller
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20240711-8aa55613"
+        app.kubernetes.io/version: "20240715-be4f06e9"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:126d608551199be48cf3bd51fa1721f1b3052653646896fdea3dd28796c2bf30
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller@sha256:2aafb3dd069e658ec0f27e84abfe02ccab637a214c2d80cf63dce95094c0ac3a
           resources:
             requests:
               cpu: 30m
@@ -416,7 +416,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   selector:
@@ -430,14 +430,14 @@ spec:
         role: net-istio-webhook
         app.kubernetes.io/component: net-istio
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20240711-8aa55613"
+        app.kubernetes.io/version: "20240715-be4f06e9"
     spec:
       serviceAccountName: controller
       containers:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:45e28fbacfde9483e2c4542b1917abf5f9373830c0a7a032c0920c07bb0b9d06
+          image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/webhook@sha256:e625409f2b5a6a87e0e3ba2a6e705e630773a121d2eb1472c968f87e77ee7e98
           resources:
             requests:
               cpu: 20m
@@ -515,7 +515,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 
 ---
@@ -542,7 +542,7 @@ metadata:
     role: net-istio-webhook
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 spec:
   ports:
@@ -581,7 +581,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -620,7 +620,7 @@ metadata:
   labels:
     app.kubernetes.io/component: net-istio
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
+    app.kubernetes.io/version: "20240715-be4f06e9"
     networking.knative.dev/ingress-provider: istio
 webhooks:
   - admissionReviewVersions:
@@ -639,38 +639,3 @@ webhooks:
         app.kubernetes.io/component: net-istio
 
 ---
-# Copyright 2023 The Knative Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: networking.internal.knative.dev/v1alpha1
-kind: Certificate
-metadata:
-  annotations:
-    networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev
-  labels:
-    app.kubernetes.io/component: net-istio
-    app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20240711-8aa55613"
-    networking.knative.dev/ingress-provider: istio
-    networking.knative.dev/certificate-type: system-internal
-    knative.dev/install-knative-certificate: "true"
-  name: routing-serving-certs
-  namespace: istio-system
-spec:
-  dnsNames:
-    - kn-routing
-  secretName: routing-serving-certs
-# The data is populated when system-internal-tls is enabled.
-
----