diff --git a/webhook/workspace/mutating_cfg.go b/webhook/workspace/mutating_cfg.go
index c7433c8c4..fb05594d8 100644
--- a/webhook/workspace/mutating_cfg.go
+++ b/webhook/workspace/mutating_cfg.go
@@ -16,6 +16,8 @@
 package workspace
 
 import (
+	"fmt"
+
 	admregv1 "k8s.io/api/admissionregistration/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -155,6 +157,9 @@ func BuildMutateWebhookCfg(namespace string) *admregv1.MutatingWebhookConfigurat
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   MutateWebhookCfgName,
 			Labels: server.WebhookServerAppLabels(),
+			Annotations: map[string]string{
+				"cert-manager.io/inject-ca-from": fmt.Sprintf("%s/devworkspace-controller-serving-cert", namespace),
+			},
 		},
 		Webhooks: []admregv1.MutatingWebhook{
 			workspaceMutateWebhook,
diff --git a/webhook/workspace/validating_cfg.go b/webhook/workspace/validating_cfg.go
index 86c22f15b..e3e3f02aa 100644
--- a/webhook/workspace/validating_cfg.go
+++ b/webhook/workspace/validating_cfg.go
@@ -16,6 +16,8 @@
 package workspace
 
 import (
+	"fmt"
+
 	admregv1 "k8s.io/api/admissionregistration/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -36,6 +38,9 @@ func buildValidatingWebhookCfg(namespace string) *admregv1.ValidatingWebhookConf
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   ValidateWebhookCfgName,
 			Labels: server.WebhookServerAppLabels(),
+			Annotations: map[string]string{
+				"cert-manager.io/inject-ca-from": fmt.Sprintf("%s/devworkspace-controller-serving-cert", namespace),
+			},
 		},
 		Webhooks: []admregv1.ValidatingWebhook{
 			{