diff --git a/licenses.d2iq.yaml b/licenses.d2iq.yaml
index 4186d9332..e7a522da0 100644
--- a/licenses.d2iq.yaml
+++ b/licenses.d2iq.yaml
@@ -579,10 +579,10 @@ resources:
       - url: https://github.com/kubernetes/kubectl
         ref: v0${image_tag#1}
         license_path: LICENSE
-  - container_image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b6
+  - container_image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3
     sources:
       - url: https://github.com/kubernetes/ingress-nginx
-        ref:  controller-v1.5.2
+        ref: controller-v1.11.2
         license_path: LICENSE
         directory: /images/kube-webhook-certgen/rootfs
   - container_image: ghcr.io/mesosphere/dkp-container-images/docker.io/bitnami/postgres-exporter:0.12.0-debian-11-r77-d2iq.0
diff --git a/services/kube-prometheus-stack/63.0.0/defaults/cm.yaml b/services/kube-prometheus-stack/63.0.0/defaults/cm.yaml
index 856d9a4f6..76c04c0cd 100644
--- a/services/kube-prometheus-stack/63.0.0/defaults/cm.yaml
+++ b/services/kube-prometheus-stack/63.0.0/defaults/cm.yaml
@@ -17,6 +17,9 @@ data:
         patch:
           priorityClassName: "dkp-critical-priority"
           image:
+            registry: registry.k8s.io
+            repository: ingress-nginx/kube-webhook-certgen
+            tag: v1.4.3
             # Set SHA to empty so airgapped deployments work out of box.
             sha: ""
     mesosphereResources: