diff --git a/apps/cert-manager/crds.yaml b/apps/cert-manager/crds.yaml
index 1a64cf85..081892b8 100644
--- a/apps/cert-manager/crds.yaml
+++ b/apps/cert-manager/crds.yaml
@@ -10,9 +10,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.2"
+    app.kubernetes.io/version: "v1.20.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.2
+    helm.sh/chart: cert-manager-v1.20.3
 spec:
   group: acme.cert-manager.io
   names:
@@ -3317,9 +3317,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.2"
+    app.kubernetes.io/version: "v1.20.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.2
+    helm.sh/chart: cert-manager-v1.20.3
 spec:
   group: acme.cert-manager.io
   names:
@@ -3599,9 +3599,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.2"
+    app.kubernetes.io/version: "v1.20.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.2
+    helm.sh/chart: cert-manager-v1.20.3
 spec:
   group: cert-manager.io
   names:
@@ -3926,9 +3926,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.2"
+    app.kubernetes.io/version: "v1.20.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.2
+    helm.sh/chart: cert-manager-v1.20.3
 spec:
   group: cert-manager.io
   names:
@@ -4747,9 +4747,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.2"
+    app.kubernetes.io/version: "v1.20.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.2
+    helm.sh/chart: cert-manager-v1.20.3
 spec:
   group: cert-manager.io
   names:
@@ -8584,9 +8584,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.2"
+    app.kubernetes.io/version: "v1.20.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.2
+    helm.sh/chart: cert-manager-v1.20.3
 spec:
   group: cert-manager.io
   names:
diff --git a/apps/cert-manager/manifests/ClusterRole-cert-manager-edit.yml b/apps/cert-manager/manifests/ClusterRole-cert-manager-edit.yml
index d49c9d2a..2695db0d 100644
--- a/apps/cert-manager/manifests/ClusterRole-cert-manager-edit.yml
+++ b/apps/cert-manager/manifests/ClusterRole-cert-manager-edit.yml
@@ -20,5 +20,8 @@ rules:
     resources: ["certificates/status"]
     verbs: ["update"]
   - apiGroups: ["acme.cert-manager.io"]
-    resources: ["challenges", "orders"]
-    verbs: ["create", "delete", "deletecollection", "patch", "update"]
+    resources: ["challenges"]
+    verbs: ["delete", "deletecollection", "patch", "update"]
+  - apiGroups: ["acme.cert-manager.io"]
+    resources: ["orders"]
+    verbs: ["delete", "deletecollection"]
diff --git a/apps/cert-manager/manifests/Deployment-cert-manager-cainjector.yml b/apps/cert-manager/manifests/Deployment-cert-manager-cainjector.yml
index 6a205fd2..6e69993b 100644
--- a/apps/cert-manager/manifests/Deployment-cert-manager-cainjector.yml
+++ b/apps/cert-manager/manifests/Deployment-cert-manager-cainjector.yml
@@ -40,7 +40,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-cainjector
-          image: "quay.io/jetstack/cert-manager-cainjector:v1.20.2"
+          image: "quay.io/jetstack/cert-manager-cainjector:v1.20.3"
           imagePullPolicy: IfNotPresent
           args:
             - --v=1
diff --git a/apps/cert-manager/manifests/Deployment-cert-manager-webhook.yml b/apps/cert-manager/manifests/Deployment-cert-manager-webhook.yml
index 2125bdcc..75855b3f 100644
--- a/apps/cert-manager/manifests/Deployment-cert-manager-webhook.yml
+++ b/apps/cert-manager/manifests/Deployment-cert-manager-webhook.yml
@@ -40,7 +40,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-webhook
-          image: "quay.io/jetstack/cert-manager-webhook:v1.20.2"
+          image: "quay.io/jetstack/cert-manager-webhook:v1.20.3"
           imagePullPolicy: IfNotPresent
           args:
             - --v=1
diff --git a/apps/cert-manager/manifests/Deployment-cert-manager.yml b/apps/cert-manager/manifests/Deployment-cert-manager.yml
index ee7e49f4..5c5558f2 100644
--- a/apps/cert-manager/manifests/Deployment-cert-manager.yml
+++ b/apps/cert-manager/manifests/Deployment-cert-manager.yml
@@ -41,13 +41,13 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-controller
-          image: "quay.io/jetstack/cert-manager-controller:v1.20.2"
+          image: "quay.io/jetstack/cert-manager-controller:v1.20.3"
           imagePullPolicy: IfNotPresent
           args:
             - --v=1
             - --cluster-resource-namespace=$(POD_NAMESPACE)
             - --leader-election-namespace=kube-system
-            - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.20.2
+            - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.20.3
             - --max-concurrent-challenges=60
           ports:
             - containerPort: 9402
diff --git a/apps/cert-manager/manifests/Job-cert-manager-startupapicheck.yml b/apps/cert-manager/manifests/Job-cert-manager-startupapicheck.yml
index 247955a4..3d6692f2 100644
--- a/apps/cert-manager/manifests/Job-cert-manager-startupapicheck.yml
+++ b/apps/cert-manager/manifests/Job-cert-manager-startupapicheck.yml
@@ -36,7 +36,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-startupapicheck
-          image: "quay.io/jetstack/cert-manager-startupapicheck:v1.20.2"
+          image: "quay.io/jetstack/cert-manager-startupapicheck:v1.20.3"
           imagePullPolicy: IfNotPresent
           args:
             - check
diff --git a/apps/cert-manager/release.yaml b/apps/cert-manager/release.yaml
index 64c31896..59d1f06a 100644
--- a/apps/cert-manager/release.yaml
+++ b/apps/cert-manager/release.yaml
@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: v1.20.2
+      version: v1.20.3
       sourceRef:
         kind: HelmRepository
         name: jetstack