diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 284eef8..e84b22f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,6 @@ jobs:
       registry-server: ghcr.io
       registry-username: ${{ github.actor }}
       image: ${{ github.repository }}
-      version: 1.12.3
+      version: 1.13.1
     secrets:
       pull-request-token: ${{ secrets.GH_ORG_PAT }}
diff --git a/package/config/upstream/net-cert-manager/net-certmanager.yaml b/package/config/upstream/net-cert-manager/net-certmanager.yaml
index 96adff7..20a5b89 100644
--- a/package/config/upstream/net-cert-manager/net-certmanager.yaml
+++ b/package/config/upstream/net-cert-manager/net-certmanager.yaml
@@ -19,7 +19,7 @@ metadata:
   name: knative-serving-certmanager
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     serving.knative.dev/controller: "true"
     networking.knative.dev/certificate-provider: cert-manager
@@ -52,7 +52,7 @@ metadata:
   name: config.webhook.net-certmanager.networking.internal.knative.dev
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 webhooks:
@@ -93,7 +93,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 
@@ -119,7 +119,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 data:
@@ -138,23 +138,32 @@ data:
     # These sample configuration options may be copied out of
     # this block and unindented to actually change the configuration.
 
-    # issuerRef is a reference to the issuer for cluster external certificates used for ingress.
+    # issuerRef is a reference to the issuer for external-domain certificates used for ingress.
     # IssuerRef should be either `ClusterIssuer` or `Issuer`.
-    # Please refer `IssuerRef` in https://github.com/cert-manager/cert-manager/tree/master/pkg/apis/certmanager/v1/types_certificate.go
+    # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/
     # for more details about IssuerRef configuration.
-    # If the issuerRef is not specified, the self-signed `knative-internal-encryption-ca` ClusterIssuer is used.
+    # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.
     issuerRef: |
       kind: ClusterIssuer
       name: letsencrypt-issuer
 
-    # clusterInternalIssuerRef is a reference to the issuer for cluster internal certificates used for ingress.
-    # ClusterInternalIssuerRef should be either `ClusterIssuer` or `Issuer`.
-    # Please refer `IssuerRef` in https://github.com/cert-manager/cert-manager/tree/master/pkg/apis/certmanager/v1/types_certificate.go
+    # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress.
+    # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`.
+    # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/
     # for more details about ClusterInternalIssuerRef configuration.
-    # If the clusterInternalIssuerRef is not specified, the self-signed `knative-internal-encryption-ca` ClusterIssuer is used.
-    clusterInternalIssuerRef: |
+    # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.
+    clusterLocalIssuerRef: |
       kind: ClusterIssuer
-      name: knative-internal-encryption-issuer
+      name: your-company-issuer
+
+    # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components.
+    # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`.
+    # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/
+    # for more details about ClusterInternalIssuerRef configuration.
+    # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.
+    systemInternalIssuerRef: |
+      kind: ClusterIssuer
+      name: knative-selfsigned-issuer
 
 ---
 # Copyright 2020 The Knative Authors
@@ -178,7 +187,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -190,7 +199,7 @@ spec:
       labels:
         app: net-certmanager-controller
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "1.12.2"
+        app.kubernetes.io/version: "1.13.0"
         app.kubernetes.io/name: knative-serving
     spec:
       serviceAccountName: controller
@@ -198,7 +207,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/net-certmanager/cmd/controller@sha256:4fa34db76f21c18112383edf8511f5ce2aba082bbae3b0441975f8d728f110ee
+          image: gcr.io/knative-releases/knative.dev/net-certmanager/cmd/controller@sha256:7a4c09c783c0cd4fab23e0ed225836e86f12b69e4f74c1fdba428fa5bea1b404
           resources:
             requests:
               cpu: 30m
@@ -239,7 +248,7 @@ metadata:
   labels:
     app: net-certmanager-controller
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
   name: net-certmanager-controller
@@ -277,37 +286,40 @@ metadata:
   name: selfsigned-cluster-issuer
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
+    knative.dev/issuer-install: "true"
 spec:
   selfSigned: {}
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: knative-internal-encryption-issuer
+  name: knative-selfsigned-issuer
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
+    knative.dev/issuer-install: "true"
 spec:
   ca:
-    secretName: knative-internal-encryption-ca
+    secretName: knative-selfsigned-ca
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: knative-internal-encryption-ca
+  name: knative-selfsigned-ca
   namespace: cert-manager #  If you want to use it as a ClusterIssuer the secret must be in the cert-manager namespace.
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
+    knative.dev/issuer-install: "true"
 spec:
-  secretName: knative-internal-encryption-ca
+  secretName: knative-selfsigned-ca
   commonName: knative.dev
   usages:
     - server auth
@@ -338,7 +350,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
@@ -351,7 +363,7 @@ spec:
       labels:
         app: net-certmanager-webhook
         app.kubernetes.io/component: net-certmanager
-        app.kubernetes.io/version: "1.12.2"
+        app.kubernetes.io/version: "1.13.0"
         app.kubernetes.io/name: knative-serving
         role: net-certmanager-webhook
     spec:
@@ -360,7 +372,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook@sha256:f8b9a7786cd00ae942abe596e1152ff6aa1727136280b1f1b6ddbafda51f684a
+          image: gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook@sha256:7b91c136d2efa59b35a60cda17a78c61142fc23713565fc5af1e369146a26a96
           resources:
             requests:
               cpu: 20m
@@ -426,7 +438,7 @@ metadata:
   labels:
     role: net-certmanager-webhook
     app.kubernetes.io/component: net-certmanager
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     app.kubernetes.io/name: knative-serving
     networking.knative.dev/certificate-provider: cert-manager
 spec:
diff --git a/package/config/upstream/net-contour/net-contour.yaml b/package/config/upstream/net-contour/net-contour.yaml
index 0f55171..3ce5ac6 100644
--- a/package/config/upstream/net-contour/net-contour.yaml
+++ b/package/config/upstream/net-contour/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,7 +38,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
 data:
   _example: |
     ################################
@@ -95,7 +95,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
 spec:
   replicas: 1
   selector:
@@ -107,14 +107,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "1.12.2"
+        app.kubernetes.io/version: "1.13.0"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/net-contour/cmd/controller@sha256:e001c6c7991a37316a38857e7a6312657a01158d91918fd9dc2d1b4f56ddef37
+          image: gcr.io/knative-releases/knative.dev/net-contour/cmd/controller@sha256:a14826bbd58f4eb73cb8af20e977b6841d29b1f7c9f8b48f24f8f36860780542
           resources:
             requests:
               cpu: 40m
@@ -158,7 +158,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.2"
+    app.kubernetes.io/version: "1.13.0"
 spec:
   delegations:
     - secretName: knative-serving-certs
diff --git a/package/config/upstream/serving/serving-core.yaml b/package/config/upstream/serving/serving-core.yaml
index 9bcbdba..179ccd1 100644
--- a/package/config/upstream/serving/serving-core.yaml
+++ b/package/config/upstream/serving/serving-core.yaml
@@ -18,7 +18,7 @@ metadata:
   name: knative-serving
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 
 ---
 # Copyright 2023 The Knative Authors
@@ -42,7 +42,7 @@ metadata:
   namespace: knative-serving
   labels:
     serving.knative.dev/controller: "true"
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -59,7 +59,7 @@ metadata:
   name: knative-serving-activator-cluster
   labels:
     serving.knative.dev/controller: "true"
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -92,7 +92,7 @@ metadata:
   # (which should be identical, but isn't guaranteed to be installed alongside serving).
   name: knative-serving-aggregated-addressable-resolver
   labels:
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 aggregationRule:
   clusterRoleSelectors:
@@ -104,7 +104,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-serving-addressable-resolver
   labels:
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
     # Labeled to facilitate aggregated cluster roles that act on Addressables.
     duck.knative.dev/addressable: "true"
@@ -143,7 +143,7 @@ metadata:
   name: knative-serving-namespaced-admin
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: ["serving.knative.dev"]
@@ -159,7 +159,7 @@ metadata:
   name: knative-serving-namespaced-edit
   labels:
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: ["serving.knative.dev"]
@@ -175,7 +175,7 @@ metadata:
   name: knative-serving-namespaced-view
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"]
@@ -203,7 +203,7 @@ metadata:
   name: knative-serving-core
   labels:
     serving.knative.dev/controller: "true"
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 rules:
   - apiGroups: [""]
@@ -257,7 +257,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: knative-serving-podspecable-binding
   labels:
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
     # Labeled to facilitate aggregated cluster roles that act on PodSpecables.
     duck.knative.dev/podspecable: "true"
@@ -296,7 +296,7 @@ metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -304,7 +304,7 @@ metadata:
   name: knative-serving-admin
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
@@ -317,7 +317,7 @@ metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 subjects:
   - kind: ServiceAccount
     name: controller
@@ -334,7 +334,7 @@ metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 subjects:
   - kind: ServiceAccount
     name: controller
@@ -352,7 +352,7 @@ metadata:
   labels:
     app.kubernetes.io/component: activator
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -362,7 +362,7 @@ metadata:
   labels:
     app.kubernetes.io/component: activator
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 subjects:
   - kind: ServiceAccount
     name: activator
@@ -379,7 +379,7 @@ metadata:
   labels:
     app.kubernetes.io/component: activator
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 subjects:
   - kind: ServiceAccount
     name: activator
@@ -410,7 +410,7 @@ metadata:
   name: images.caching.internal.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: caching.internal.knative.dev
@@ -532,7 +532,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: networking
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: networking.internal.knative.dev
@@ -681,7 +681,7 @@ metadata:
   name: configurations.serving.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
     duck.knative.dev/podspecable: "true"
 spec:
@@ -1187,7 +1187,7 @@ spec:
                                       - type
                                     properties:
                                       localhostProfile:
-                                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must only be set if type is "Localhost".
+                                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
                                         type: string
                                       type:
                                         description: "type indicates which kind of seccomp profile will be applied. Valid options are: \n Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied."
@@ -1617,7 +1617,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: networking
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: networking.internal.knative.dev
@@ -1681,7 +1681,7 @@ metadata:
   name: domainmappings.serving.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: serving.knative.dev
@@ -1847,7 +1847,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: networking
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: networking.internal.knative.dev
@@ -2107,7 +2107,7 @@ metadata:
   name: metrics.autoscaling.internal.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: autoscaling.internal.knative.dev
@@ -2229,7 +2229,7 @@ metadata:
   name: podautoscalers.autoscaling.internal.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: autoscaling.internal.knative.dev
@@ -2389,7 +2389,7 @@ metadata:
   name: revisions.serving.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: serving.knative.dev
@@ -2874,7 +2874,7 @@ spec:
                               - type
                             properties:
                               localhostProfile:
-                                description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must only be set if type is "Localhost".
+                                description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
                                 type: string
                               type:
                                 description: "type indicates which kind of seccomp profile will be applied. Valid options are: \n Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied."
@@ -3332,7 +3332,7 @@ metadata:
   name: routes.serving.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
 spec:
@@ -3515,7 +3515,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: networking
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
 spec:
   group: networking.internal.knative.dev
@@ -3681,7 +3681,7 @@ metadata:
   name: services.serving.knative.dev
   labels:
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
     duck.knative.dev/podspecable: "true"
@@ -4191,7 +4191,7 @@ spec:
                                       - type
                                     properties:
                                       localhostProfile:
-                                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must only be set if type is "Localhost".
+                                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
                                         type: string
                                       type:
                                         description: "type indicates which kind of seccomp profile will be applied. Valid options are: \n Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied."
@@ -4743,11 +4743,11 @@ metadata:
   labels:
     app.kubernetes.io/component: queue-proxy
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   # This is the Go import path for the binary that is containerized
   # and substituted here.
-  image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:739d6ce20e3a4eb646d47472163eca88df59bb637cad4d1e100de07a15fe63a2
+  image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:e52286fc4843470383e917abc9c1b0c8d10f585c4274c57b612279869bc86f0d
 
 ---
 # Copyright 2018 The Knative Authors
@@ -4772,7 +4772,7 @@ metadata:
   labels:
     app.kubernetes.io/component: autoscaler
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "47c2487f"
 data:
@@ -4983,7 +4983,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: controller
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "e7973912"
 data:
@@ -5138,13 +5138,13 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: controller
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "ed77183a"
 data:
   # This is the Go import path for the binary that is containerized
   # and substituted here.
-  queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:739d6ce20e3a4eb646d47472163eca88df59bb637cad4d1e100de07a15fe63a2
+  queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:e52286fc4843470383e917abc9c1b0c8d10f585c4274c57b612279869bc86f0d
   _example: |-
     ################################
     #                              #
@@ -5233,7 +5233,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: controller
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "26c09de5"
 data:
@@ -5298,7 +5298,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: controller
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "f2fc138e"
 data:
@@ -5512,7 +5512,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: controller
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "aa3813a8"
 data:
@@ -5612,7 +5612,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: controller
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "f4b71f57"
 data:
@@ -5672,7 +5672,7 @@ metadata:
   name: config-logging
   namespace: knative-serving
   labels:
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/component: logging
     app.kubernetes.io/name: knative-serving
   annotations:
@@ -5756,7 +5756,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: networking
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "0573e07d"
 data:
@@ -5961,7 +5961,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: observability
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "54abd711"
 data:
@@ -6081,7 +6081,7 @@ metadata:
   labels:
     app.kubernetes.io/name: knative-serving
     app.kubernetes.io/component: tracing
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   annotations:
     knative.dev/example-checksum: "26614636"
 data:
@@ -6138,7 +6138,7 @@ metadata:
   labels:
     app.kubernetes.io/component: activator
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   minReplicas: 1
   maxReplicas: 20
@@ -6166,7 +6166,7 @@ metadata:
   labels:
     app.kubernetes.io/component: activator
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   minAvailable: 80%
   selector:
@@ -6195,7 +6195,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: activator
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 spec:
   selector:
@@ -6209,14 +6209,14 @@ spec:
         role: activator
         app.kubernetes.io/component: activator
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "1.12.3"
+        app.kubernetes.io/version: "1.13.1"
     spec:
       serviceAccountName: activator
       containers:
         - name: activator
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:eff69d2271dde5f4ad0eb665d8a493773d7c78da05c2a5ef94c1d84dcac37cf1
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:21f8e11a44bf1e260602d30e6762a3dc433c608d1dd0e309c0ff89728e71901d
           # The numbers are based on performance test results from
           # https://github.com/knative/serving/issues/1625#issuecomment-511930023
           resources:
@@ -6301,7 +6301,7 @@ metadata:
   labels:
     app: activator
     app.kubernetes.io/component: activator
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 spec:
   selector:
@@ -6348,7 +6348,7 @@ metadata:
   labels:
     app.kubernetes.io/component: autoscaler
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   replicas: 1
   selector:
@@ -6364,7 +6364,7 @@ spec:
         app: autoscaler
         app.kubernetes.io/component: autoscaler
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "1.12.3"
+        app.kubernetes.io/version: "1.13.1"
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
       affinity:
@@ -6381,7 +6381,7 @@ spec:
         - name: autoscaler
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:7908e2a3e2238d14044527f8f991cc76492e0de2110e2abef5e3ee4a59b43c4f
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:34796e9f760bb67065c6f101296513b38d04d39d11888e919692ac46fa6dc7c2
           resources:
             requests:
               cpu: 100m
@@ -6446,7 +6446,7 @@ metadata:
     app: autoscaler
     app.kubernetes.io/component: autoscaler
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   name: autoscaler
   namespace: knative-serving
 spec:
@@ -6487,7 +6487,7 @@ metadata:
   labels:
     app.kubernetes.io/component: controller
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   selector:
     matchLabels:
@@ -6498,7 +6498,7 @@ spec:
         app: controller
         app.kubernetes.io/component: controller
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "1.12.3"
+        app.kubernetes.io/version: "1.13.1"
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
       affinity:
@@ -6515,7 +6515,7 @@ spec:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:ea0f8f2ed5a603c42687ad397a4826bb720ea50ce39eef1b3a03927a920e4bc0
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:53d9aa4d2c7a82f5a01202e386f7503b21839cbe2e5e62f1e9bda2aa5f11b518
           resources:
             requests:
               cpu: 100m
@@ -6577,7 +6577,7 @@ metadata:
     app: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   name: controller
   namespace: knative-serving
 spec:
@@ -6615,7 +6615,7 @@ metadata:
   labels:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   minReplicas: 1
   maxReplicas: 5
@@ -6641,7 +6641,7 @@ metadata:
   labels:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   minAvailable: 80%
   selector:
@@ -6670,7 +6670,7 @@ metadata:
   namespace: knative-serving
   labels:
     app.kubernetes.io/component: webhook
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
 spec:
   selector:
@@ -6683,7 +6683,7 @@ spec:
         app: webhook
         role: webhook
         app.kubernetes.io/component: webhook
-        app.kubernetes.io/version: "1.12.3"
+        app.kubernetes.io/version: "1.13.1"
         app.kubernetes.io/name: knative-serving
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
@@ -6701,7 +6701,7 @@ spec:
         - name: webhook
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8883f4fff5c56ed512cc4a3a3ab178b7a3366e58ea2e6aee83d33bc6d287aa48
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:700c69915dc7cd86dffb61c26b0ba34427fab809de1e3344589dd955b6440882
           resources:
             requests:
               cpu: 100m
@@ -6774,7 +6774,7 @@ metadata:
     app: webhook
     role: webhook
     app.kubernetes.io/component: webhook
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
     app.kubernetes.io/name: knative-serving
   name: webhook
   namespace: knative-serving
@@ -6816,7 +6816,7 @@ metadata:
   labels:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
     clientConfig:
@@ -6858,7 +6858,7 @@ metadata:
   labels:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
     clientConfig:
@@ -6915,7 +6915,7 @@ metadata:
   labels:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
     clientConfig:
@@ -6974,7 +6974,7 @@ metadata:
   labels:
     app.kubernetes.io/component: webhook
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 # The data is populated at install time.
 
 ---
diff --git a/package/config/upstream/serving/serving-hpa.yaml b/package/config/upstream/serving/serving-hpa.yaml
index 0c7d912..d20732f 100644
--- a/package/config/upstream/serving/serving-hpa.yaml
+++ b/package/config/upstream/serving/serving-hpa.yaml
@@ -21,7 +21,7 @@ metadata:
     autoscaling.knative.dev/autoscaler-provider: hpa
     app.kubernetes.io/component: autoscaler-hpa
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
 spec:
   selector:
     matchLabels:
@@ -32,7 +32,7 @@ spec:
         app: autoscaler-hpa
         app.kubernetes.io/component: autoscaler-hpa
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "1.12.3"
+        app.kubernetes.io/version: "1.13.1"
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
       affinity:
@@ -49,7 +49,7 @@ spec:
         - name: autoscaler-hpa
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa@sha256:f765925786e92f156c54ef8988893b230cadd155848781b53dc5d39f8cf55c5a
+          image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa@sha256:fbb38c9b3175b216c3d179e72315a0b4b67ddbf222e0ef9b6a78e2dbc4d797d6
           resources:
             requests:
               cpu: 30m
@@ -108,7 +108,7 @@ metadata:
     autoscaling.knative.dev/autoscaler-provider: hpa
     app.kubernetes.io/component: autoscaler-hpa
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "1.12.3"
+    app.kubernetes.io/version: "1.13.1"
   name: autoscaler-hpa
   namespace: knative-serving
 spec:
diff --git a/package/vendir.lock.yml b/package/vendir.lock.yml
index c6485bf..257f563 100644
--- a/package/vendir.lock.yml
+++ b/package/vendir.lock.yml
@@ -2,16 +2,16 @@ apiVersion: vendir.k14s.io/v1alpha1
 directories:
 - contents:
   - githubRelease:
-      tag: knative-v1.12.3
-      url: https://api.github.com/repos/knative/serving/releases/134455415
+      tag: knative-v1.13.1
+      url: https://api.github.com/repos/knative/serving/releases/139777135
     path: serving
   - githubRelease:
-      tag: knative-v1.12.2
-      url: https://api.github.com/repos/knative-extensions/net-contour/releases/134447800
+      tag: knative-v1.13.0
+      url: https://api.github.com/repos/knative-extensions/net-contour/releases/138278321
     path: net-contour
   - githubRelease:
-      tag: knative-v1.12.2
-      url: https://api.github.com/repos/knative-extensions/net-certmanager/releases/134441345
+      tag: knative-v1.13.0
+      url: https://api.github.com/repos/knative-extensions/net-certmanager/releases/138275993
     path: net-cert-manager
   path: config/upstream
 kind: LockConfig
diff --git a/package/vendir.yml b/package/vendir.yml
index 8f10de2..97b5fff 100644
--- a/package/vendir.yml
+++ b/package/vendir.yml
@@ -4,7 +4,7 @@ directories:
   - githubRelease:
       disableAutoChecksumValidation: true
       slug: knative/serving
-      tag: knative-v1.12.3
+      tag: knative-v1.13.1
     includePaths:
     - serving-core.yaml
     - serving-hpa.yaml
@@ -12,14 +12,14 @@ directories:
   - githubRelease:
       disableAutoChecksumValidation: true
       slug: knative-extensions/net-contour
-      tag: knative-v1.12.2
+      tag: knative-v1.13.0
     includePaths:
     - net-contour.yaml
     path: net-contour
   - githubRelease:
       disableAutoChecksumValidation: true
       slug: knative-extensions/net-certmanager
-      tag: knative-v1.12.2
+      tag: knative-v1.13.0
     includePaths:
     - net-certmanager.yaml
     path: net-cert-manager
diff --git a/test/integration/kuttl-test.yml b/test/integration/kuttl-test.yml
index 396b477..368bc31 100644
--- a/test/integration/kuttl-test.yml
+++ b/test/integration/kuttl-test.yml
@@ -17,11 +17,11 @@ commands:
   - script: |
       kubectl config set-context --current --namespace=tests && \
       kapp deploy -a contour-package -y \
-        -f https://github.com/kadras-io/package-for-contour/releases/download/v1.27.0/package.yml \
-        -f https://github.com/kadras-io/package-for-contour/releases/download/v1.27.0/metadata.yml
+        -f https://github.com/kadras-io/package-for-contour/releases/download/v1.28.1/package.yml \
+        -f https://github.com/kadras-io/package-for-contour/releases/download/v1.28.1/metadata.yml
       kapp deploy -a cert-manager-package -y \
-        -f https://github.com/kadras-io/package-for-cert-manager/releases/download/v1.13.2/package.yml \
-        -f https://github.com/kadras-io/package-for-cert-manager/releases/download/v1.13.2/metadata.yml
+        -f https://github.com/kadras-io/package-for-cert-manager/releases/download/v1.14.3/package.yml \
+        -f https://github.com/kadras-io/package-for-cert-manager/releases/download/v1.14.3/metadata.yml
   - script: |
       kubectl config set-context --current --namespace=tests && \
       kapp deploy -a dependencies -y -f ./test/setup/dependencies
diff --git a/test/setup/dependencies/cert-manager.yml b/test/setup/dependencies/cert-manager.yml
index 8201c9b..6cd3db1 100644
--- a/test/setup/dependencies/cert-manager.yml
+++ b/test/setup/dependencies/cert-manager.yml
@@ -12,7 +12,7 @@ spec:
   packageRef:
     refName: cert-manager.packages.kadras.io
     versionSelection:
-      constraints: 1.13.2
+      constraints: 1.14.3
   values:
     - secretRef:
         name: cert-manager-values
diff --git a/test/setup/dependencies/contour.yml b/test/setup/dependencies/contour.yml
index 49486dc..157001e 100644
--- a/test/setup/dependencies/contour.yml
+++ b/test/setup/dependencies/contour.yml
@@ -12,7 +12,7 @@ spec:
   packageRef:
     refName: contour.packages.kadras.io
     versionSelection:
-      constraints: 1.27.0
+      constraints: 1.28.1
   values:
     - secretRef:
         name: contour-values
diff --git a/test/setup/kind/v1.27/kind-config.yml b/test/setup/kind/v1.27/kind-config.yml
index 42ad0ae..b69a19e 100644
--- a/test/setup/kind/v1.27/kind-config.yml
+++ b/test/setup/kind/v1.27/kind-config.yml
@@ -3,10 +3,10 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
 - role: control-plane
-  image: kindest/node:v1.27.3
+  image: kindest/node:v1.27.11
 - role: worker
-  image: kindest/node:v1.27.3
+  image: kindest/node:v1.27.11
 - role: worker
-  image: kindest/node:v1.27.3
+  image: kindest/node:v1.27.11
 - role: worker
-  image: kindest/node:v1.27.3
+  image: kindest/node:v1.27.11
diff --git a/test/setup/kind/v1.28/kind-config.yml b/test/setup/kind/v1.28/kind-config.yml
index 0f13b9e..99af0ca 100644
--- a/test/setup/kind/v1.28/kind-config.yml
+++ b/test/setup/kind/v1.28/kind-config.yml
@@ -3,10 +3,10 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
 - role: control-plane
-  image: kindest/node:v1.28.0
+  image: kindest/node:v1.28.7
 - role: worker
-  image: kindest/node:v1.28.0
+  image: kindest/node:v1.28.7
 - role: worker
-  image: kindest/node:v1.28.0
+  image: kindest/node:v1.28.7
 - role: worker
-  image: kindest/node:v1.28.0
+  image: kindest/node:v1.28.7
diff --git a/test/setup/kind/v1.29/kind-config.yml b/test/setup/kind/v1.29/kind-config.yml
index 7b54b17..2a633e6 100644
--- a/test/setup/kind/v1.29/kind-config.yml
+++ b/test/setup/kind/v1.29/kind-config.yml
@@ -3,10 +3,10 @@ kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
 - role: control-plane
-  image: kindest/node:v1.29.0
+  image: kindest/node:v1.29.2
 - role: worker
-  image: kindest/node:v1.29.0
+  image: kindest/node:v1.29.2
 - role: worker
-  image: kindest/node:v1.29.0
+  image: kindest/node:v1.29.2
 - role: worker
-  image: kindest/node:v1.29.0
+  image: kindest/node:v1.29.2