diff --git a/third_party/contour-latest/contour.yaml b/third_party/contour-latest/contour.yaml
index 6cd6bfc375e7..3f92b1e7ed91 100644
--- a/third_party/contour-latest/contour.yaml
+++ b/third_party/contour-latest/contour.yaml
@@ -8836,7 +8836,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1-33-2
+  name: contour-certgen-v1-33-3
   namespace: contour-external
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -8848,7 +8848,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -9090,7 +9090,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -9174,7 +9174,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -9202,7 +9202,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:distroless-v1.35.8
+          image: docker.io/envoyproxy/envoy:distroless-v1.35.9
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -9267,7 +9267,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
@@ -9566,7 +9566,7 @@ rules:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: contour-certgen-v1-33-2
+  name: contour-certgen-v1-33-3
   namespace: contour-internal
   labels:
     networking.knative.dev/ingress-provider: contour
@@ -9578,7 +9578,7 @@ spec:
     spec:
       containers:
         - name: contour
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           command:
             - contour
@@ -9728,7 +9728,7 @@ spec:
             - --config-path=/config/contour.yaml
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           name: contour
           ports:
@@ -9812,7 +9812,7 @@ spec:
           args:
             - envoy
             - shutdown-manager
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           lifecycle:
             preStop:
@@ -9840,7 +9840,7 @@ spec:
             - --log-level info
           command:
             - envoy
-          image: docker.io/envoyproxy/envoy:distroless-v1.35.8
+          image: docker.io/envoyproxy/envoy:distroless-v1.35.9
           imagePullPolicy: IfNotPresent
           name: envoy
           env:
@@ -9905,7 +9905,7 @@ spec:
             - --envoy-key-file=/certs/tls.key
           command:
             - contour
-          image: ghcr.io/projectcontour/contour:v1.33.2
+          image: ghcr.io/projectcontour/contour:v1.33.3
           imagePullPolicy: IfNotPresent
           name: envoy-initconfig
           volumeMounts:
diff --git a/third_party/contour-latest/net-contour.yaml b/third_party/contour-latest/net-contour.yaml
index 30374da74489..37b38e7b9aea 100644
--- a/third_party/contour-latest/net-contour.yaml
+++ b/third_party/contour-latest/net-contour.yaml
@@ -8,7 +8,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20260401-b79d3676"
+    app.kubernetes.io/version: "20260403-5ceb6da3"
     serving.knative.dev/controller: "true"
 rules:
   - apiGroups: ["projectcontour.io"]
@@ -38,7 +38,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20260401-b79d3676"
+    app.kubernetes.io/version: "20260403-5ceb6da3"
 data:
   _example: |
     ################################
@@ -111,7 +111,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20260401-b79d3676"
+    app.kubernetes.io/version: "20260403-5ceb6da3"
 spec:
   replicas: 1
   selector:
@@ -123,14 +123,14 @@ spec:
         app: net-contour-controller
         app.kubernetes.io/component: net-contour
         app.kubernetes.io/name: knative-serving
-        app.kubernetes.io/version: "20260401-b79d3676"
+        app.kubernetes.io/version: "20260403-5ceb6da3"
     spec:
       serviceAccountName: controller
       containers:
         - name: controller
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:7f20f19e30065a39ac64ec11a323f16238ce9e075754dfa1c1c221f5b612daea
+          image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller@sha256:6c4ad33a8e5d87ab57bed32bb91af5dd3d7d0ec03ce840d8b97d53949846ec42
           resources:
             requests:
               cpu: 40m
@@ -174,7 +174,7 @@ metadata:
     networking.knative.dev/ingress-provider: contour
     app.kubernetes.io/component: net-contour
     app.kubernetes.io/name: knative-serving
-    app.kubernetes.io/version: "20260401-b79d3676"
+    app.kubernetes.io/version: "20260403-5ceb6da3"
 spec:
   delegations:
     - secretName: routing-serving-certs