diff --git a/00-defs/49-cert-manager-crd.yaml b/00-defs/49-cert-manager-crd.yaml
--- a/00-defs/49-cert-manager-crd.yaml
+++ b/00-defs/49-cert-manager-crd.yaml
@@ -7,8 +7,6 @@ metadata:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
-    # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
 spec:
   group: cert-manager.io
   names:
@@ -208,7 +206,7 @@ metadata:
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: cert-manager.io
   names:
@@ -581,7 +579,7 @@ metadata:
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: acme.cert-manager.io
   names:
@@ -1628,7 +1626,7 @@ metadata:
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: cert-manager.io
   names:
@@ -2890,7 +2888,7 @@ metadata:
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: cert-manager.io
   names:
@@ -4152,7 +4150,7 @@ metadata:
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: acme.cert-manager.io
   names:
diff --git a/kube/04-gen-secrets-job.yaml b/04-gen-secrets-job.yaml
rename from kube/04-gen-secrets-job.yaml
rename to 04-gen-secrets-job.yaml
--- a/kube/04-gen-secrets-job.yaml
+++ b/04-gen-secrets-job.yaml
@@ -21,7 +21,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: pomerium/ingress-controller:main
+        image: pomerium/ingress-controller:sha-efe2d11
         imagePullPolicy: IfNotPresent
         name: gen-secrets
         securityContext:
diff --git a/20-kube/20-pom-deploy.yaml b/20-kube/20-pom-deploy.yaml
--- a/20-kube/20-pom-deploy.yaml
+++ b/20-kube/20-pom-deploy.yaml
@@ -30,7 +30,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: status.podIP
-          image: pomerium/ingress-controller:sha-5294279
+          image: pomerium/ingress-controller:sha-efe2d11
           imagePullPolicy: IfNotPresent
           name: pomerium
           ports: