diff --git a/controller/webhook/server.go b/controller/webhook/server.go
index 664d1d1ea..8263e92f9 100644
--- a/controller/webhook/server.go
+++ b/controller/webhook/server.go
@@ -65,7 +65,7 @@ func NewServer(
 		Addr:              addr,
 		ReadHeaderTimeout: 15 * time.Second,
 		TLSConfig: &tls.Config{
-			MinVersion: tls.VersionTLS12,
+			MinVersion: tls.VersionTLS13,
 		},
 	}
 
diff --git a/controller/webhook/server_test.go b/controller/webhook/server_test.go
index 977206c61..375f1257a 100644
--- a/controller/webhook/server_test.go
+++ b/controller/webhook/server_test.go
@@ -18,7 +18,7 @@ var mockHTTPServer = &http.Server{
 	Addr:              ":0",
 	ReadHeaderTimeout: 15 * time.Second,
 	TLSConfig: &tls.Config{
-		MinVersion: tls.VersionTLS12,
+		MinVersion: tls.VersionTLS13,
 	},
 }
 
diff --git a/viz/tap/api/server.go b/viz/tap/api/server.go
index 42b2113c2..0a04b42d5 100644
--- a/viz/tap/api/server.go
+++ b/viz/tap/api/server.go
@@ -74,7 +74,7 @@ func NewServer(
 		TLSConfig: &tls.Config{
 			ClientAuth: tls.VerifyClientCertIfGiven,
 			ClientCAs:  clientCertPool,
-			MinVersion: tls.VersionTLS12,
+			MinVersion: tls.VersionTLS13,
 		},
 	}