diff --git a/buildchain/buildchain/constants.py b/buildchain/buildchain/constants.py
index be8ce1c7bf..945105f988 100644
--- a/buildchain/buildchain/constants.py
+++ b/buildchain/buildchain/constants.py
@@ -31,6 +31,7 @@
 PROMETHEUS_OPERATOR_REPOSITORY: str = "quay.io/prometheus-operator"
 PROMETHEUS_REPOSITORY: str = "quay.io/prometheus"
 THANOS_REPOSITORY: str = "quay.io/thanos"
+CERT_MANAGER_REPOSITORY: str = "quay.io/jetstack"
 
 # Paths {{{
 
diff --git a/buildchain/buildchain/image.py b/buildchain/buildchain/image.py
index 1d36e2962b..42e1f0ad5c 100644
--- a/buildchain/buildchain/image.py
+++ b/buildchain/buildchain/image.py
@@ -211,6 +211,13 @@ def _local_image(name: str, **kwargs: Any) -> targets.LocalImage:
     constants.THANOS_REPOSITORY: [
         "thanos",
     ],
+    constants.CERT_MANAGER_REPOSITORY: [
+        "cert-manager-controller",
+        "cert-manager-webhook",
+        "cert-manager-cainjector",
+        "cert-manager-acmesolver",
+        "cert-manager-startupapicheck",
+    ],
 }
 
 REMOTE_NAMES: Dict[str, str] = {
diff --git a/buildchain/buildchain/versions.py b/buildchain/buildchain/versions.py
index 45abcb5506..43bf81ad49 100644
--- a/buildchain/buildchain/versions.py
+++ b/buildchain/buildchain/versions.py
@@ -81,6 +81,7 @@ def load_version_information() -> None:
 NGINX_IMAGE_VERSION: str = "1.27.0-alpine"
 NODEJS_IMAGE_VERSION: str = "16.14.0"
 KEEPALIVED_VERSION: str = "2.3.1"
+CERT_MANAGER_VERSION: str = "1.15.3"
 
 # Current build IDs, to be augmented whenever we rebuild the corresponding
 # image, e.g. because the `Dockerfile` is changed, or one of the dependencies
@@ -271,6 +272,31 @@ def _version_prefix(version: str, prefix: str = "v") -> str:
         version="2.2.2",
         digest="sha256:bc89a87cc9cd40c320644835b83170f49819dc3ea447e38c71dde27a181e7a9b",
     ),
+    Image(
+        name="cert-manager-controller",
+        version=_version_prefix(CERT_MANAGER_VERSION),
+        digest="sha256:eee34b3de2dd63f7e5ac459fc2d407662d433fd267d574557b76ee3c7d4bc44f",
+    ),
+    Image(
+        name="cert-manager-webhook",
+        version=_version_prefix(CERT_MANAGER_VERSION),
+        digest="sha256:fdcb9ac4963fa1bb0c9d7cad38f0ba2c65328aa436f8653c998594d936a96488",
+    ),
+    Image(
+        name="cert-manager-cainjector",
+        version=_version_prefix(CERT_MANAGER_VERSION),
+        digest="sha256:e0ce8ae280c8d7263663b6a6d3ea5e122632936cde9bdd5321cf7109199f51aa",
+    ),
+    Image(
+        name="cert-manager-acmesolver",
+        version=_version_prefix(CERT_MANAGER_VERSION),
+        digest="sha256:71468feed486c4cf3ca431d93f996771531ab2e68f261f1a15be845720802a8a",
+    ),
+    Image(
+        name="cert-manager-startupapicheck",
+        version=_version_prefix(CERT_MANAGER_VERSION),
+        digest="sha256:4cbc1b022a2385ce98d454dfc206834a26a3bb07d1d0b581cdc50c34a6bf927d",
+    ),
 )
 
 CONTAINER_IMAGES_MAP = {image.name: image for image in CONTAINER_IMAGES}