diff --git a/third_party/eventing-latest/eventing-core.yaml b/third_party/eventing-latest/eventing-core.yaml
index 220e134c01..4e600a64f2 100644
--- a/third_party/eventing-latest/eventing-core.yaml
+++ b/third_party/eventing-latest/eventing-core.yaml
@@ -16,7 +16,7 @@ kind: Namespace
 metadata:
   name: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 
 ---
@@ -40,7 +40,7 @@ metadata:
   name: eventing-controller
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -48,7 +48,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -64,7 +64,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-resolver
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -80,7 +80,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-source-observer
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -96,7 +96,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-sources-controller
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -112,7 +112,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-controller-manipulator
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -122,6 +122,22 @@ roleRef:
   kind: ClusterRole
   name: channelable-manipulator
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eventing-controller-crossnamespace-subscriber
+  labels:
+    app.kubernetes.io/version: "20240609-844dcbf03"
+    app.kubernetes.io/name: knative-eventing
+subjects:
+  - kind: ServiceAccount
+    name: eventing-controller
+    namespace: knative-eventing
+roleRef:
+  kind: ClusterRole
+  name: crossnamespace-subscriber
+  apiGroup: rbac.authorization.k8s.io
 
 ---
 # Copyright 2020 The Knative Authors
@@ -144,7 +160,7 @@ metadata:
   name: job-sink
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -152,7 +168,7 @@ kind: ClusterRoleBinding
 metadata:
   name: knative-eventing-job-sink
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -184,7 +200,7 @@ metadata:
   name: pingsource-mt-adapter
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -192,7 +208,7 @@ kind: ClusterRoleBinding
 metadata:
   name: knative-eventing-pingsource-mt-adapter
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -224,7 +240,7 @@ metadata:
   name: eventing-webhook
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -232,7 +248,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-webhook
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -249,7 +265,7 @@ metadata:
   namespace: knative-eventing
   name: eventing-webhook
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -265,7 +281,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-webhook-resolver
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -281,7 +297,7 @@ kind: ClusterRoleBinding
 metadata:
   name: eventing-webhook-podspecable-binding
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 subjects:
   - kind: ServiceAccount
@@ -313,7 +329,7 @@ metadata:
   name: config-br-default-channel
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 data:
   channel-template-spec: |
@@ -341,7 +357,7 @@ metadata:
   name: config-br-defaults
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 data:
   # Configures the default for any Broker that does not specify a spec.config or Broker class.
@@ -378,7 +394,7 @@ metadata:
   name: default-ch-webhook
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 data:
   # Configuration for defaulting channels that do not specify CRD implementations.
@@ -413,7 +429,7 @@ metadata:
   namespace: knative-eventing
   annotations:
     knative.dev/example-checksum: "9185c153"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 data:
   _example: |
@@ -459,7 +475,7 @@ metadata:
   labels:
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 data:
   # ALPHA feature: The kreference-group allows you to use the Group field in KReferences.
@@ -563,7 +579,7 @@ metadata:
   name: config-leader-election
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "f7948630"
@@ -626,7 +642,7 @@ metadata:
   labels:
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 data:
   # Common configuration for all Knative codebase
@@ -679,7 +695,7 @@ metadata:
   labels:
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "f46cf09d"
@@ -753,7 +769,7 @@ metadata:
   name: config-sugar
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "62dfac6f"
@@ -812,7 +828,7 @@ metadata:
   labels:
     knative.dev/config-propagation: original
     knative.dev/config-category: eventing
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     knative.dev/example-checksum: "0492ceb0"
@@ -869,7 +885,7 @@ metadata:
   labels:
     knative.dev/high-availability: "true"
     app.kubernetes.io/component: eventing-controller
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   selector:
@@ -880,7 +896,7 @@ spec:
       labels:
         app: eventing-controller
         app.kubernetes.io/component: eventing-controller
-        app.kubernetes.io/version: "20240605-bff65d2c2"
+        app.kubernetes.io/version: "20240609-844dcbf03"
         app.kubernetes.io/name: knative-eventing
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
@@ -898,7 +914,7 @@ spec:
       containers:
         - name: eventing-controller
           terminationMessagePolicy: FallbackToLogsOnError
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller@sha256:b57ce14dddf2d21e7075e44de53583dcf67dac52b18915ca740849e0c65466b8
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller@sha256:2851dc1164e7492667fb3b269ad88146cf05c729178fa8bbe18b2d1be92e9e97
           resources:
             requests:
               cpu: 100m
@@ -916,7 +932,7 @@ spec:
               value: knative.dev/eventing
             # APIServerSource
             - name: APISERVER_RA_IMAGE
-              value: gcr.io/knative-nightly/knative.dev/eventing/cmd/apiserver_receive_adapter@sha256:44f5799b8fe12936e0869c6620a3602efa8b996be62160d09e96c03fe9b4dcec
+              value: gcr.io/knative-nightly/knative.dev/eventing/cmd/apiserver_receive_adapter@sha256:63ea86400f6f46f32db17b57786416f7b0bf0facd7ea5a3a4dc59b574e7cd0e6
             - name: POD_NAME
               valueFrom:
                 fieldRef:
@@ -986,7 +1002,7 @@ metadata:
   namespace: knative-eventing
   labels:
     app.kubernetes.io/component: job-sink
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   replicas: 1
@@ -998,7 +1014,7 @@ spec:
       labels:
         sinks.knative.dev/sink: job-sink
         app.kubernetes.io/component: job-sink
-        app.kubernetes.io/version: "20240605-bff65d2c2"
+        app.kubernetes.io/version: "20240609-844dcbf03"
         app.kubernetes.io/name: knative-eventing
     spec:
       affinity:
@@ -1014,7 +1030,7 @@ spec:
       containers:
         - name: job-sink
           terminationMessagePolicy: FallbackToLogsOnError
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/jobsink@sha256:bb1bbf051f4c990749a117a1fc8d4b7c086e3b2c11f6cefccd93ead6d0b7691c
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/jobsink@sha256:68fba02f0bdaaa298d545c420072632ca5ee768485b7b47cbfa8a639aab4d53e
           env:
             - name: SYSTEM_NAMESPACE
               valueFrom:
@@ -1096,7 +1112,7 @@ metadata:
   labels:
     sinks.knative.dev/sink: job-sink
     app.kubernetes.io/component: job-sink
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   name: job-sink
   namespace: knative-eventing
@@ -1139,7 +1155,7 @@ metadata:
   namespace: knative-eventing
   labels:
     app.kubernetes.io/component: pingsource-mt-adapter
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   # when set to 0 (and only 0) will be set to 1 when the first PingSource is created.
@@ -1154,7 +1170,7 @@ spec:
         eventing.knative.dev/source: ping-source-controller
         sources.knative.dev/role: adapter
         app.kubernetes.io/component: pingsource-mt-adapter
-        app.kubernetes.io/version: "20240605-bff65d2c2"
+        app.kubernetes.io/version: "20240609-844dcbf03"
         app.kubernetes.io/name: knative-eventing
     spec:
       affinity:
@@ -1170,7 +1186,7 @@ spec:
       enableServiceLinks: false
       containers:
         - name: dispatcher
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/mtping@sha256:eb2421a5f13b792c0576cbeb9f1b23d366dbd6b3ce6bab9ee081a3f9a9439563
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/mtping@sha256:5e0a52cc9857e0651a0251fa387e833add140aac341824ad0ffa494051f0c658
           env:
             - name: SYSTEM_NAMESPACE
               value: ''
@@ -1244,7 +1260,7 @@ metadata:
   namespace: knative-eventing
   labels:
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   scaleTargetRef:
@@ -1269,7 +1285,7 @@ metadata:
   namespace: knative-eventing
   labels:
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   minAvailable: 80%
@@ -1299,7 +1315,7 @@ metadata:
   namespace: knative-eventing
   labels:
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   selector:
@@ -1312,7 +1328,7 @@ spec:
         app: eventing-webhook
         role: eventing-webhook
         app.kubernetes.io/component: eventing-webhook
-        app.kubernetes.io/version: "20240605-bff65d2c2"
+        app.kubernetes.io/version: "20240609-844dcbf03"
         app.kubernetes.io/name: knative-eventing
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
@@ -1332,7 +1348,7 @@ spec:
           terminationMessagePolicy: FallbackToLogsOnError
           # This is the Go import path for the binary that is containerized
           # and substituted here.
-          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/webhook@sha256:1c30f350ca73cfc2c717e39ccb88fde8be7b33def8a6eec44cbde530500cb5af
+          image: gcr.io/knative-nightly/knative.dev/eventing/cmd/webhook@sha256:5e5d8f3202216c55c340078f13b298b410243798accd4c8f764efe1fa45ecd7a
           resources:
             requests:
               # taken from serving.
@@ -1411,7 +1427,7 @@ metadata:
   labels:
     role: eventing-webhook
     app.kubernetes.io/component: eventing-webhook
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   name: eventing-webhook
   namespace: knative-eventing
@@ -1446,7 +1462,7 @@ metadata:
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schemas
@@ -1733,7 +1749,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -1936,7 +1952,7 @@ metadata:
     knative.dev/crd-install: "true"
     messaging.knative.dev/subscribable: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -2282,7 +2298,7 @@ metadata:
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   name: containersources.sources.knative.dev
 spec:
@@ -2457,7 +2473,7 @@ metadata:
   name: eventtypes.eventing.knative.dev
   labels:
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -2850,7 +2866,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: sinks.knative.dev
@@ -2985,7 +3001,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -3501,7 +3517,7 @@ metadata:
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schema
@@ -3873,7 +3889,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -4245,7 +4261,7 @@ metadata:
     duck.knative.dev/source: "true"
     duck.knative.dev/binding: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   name: sinkbindings.sources.knative.dev
 spec:
@@ -4460,7 +4476,7 @@ metadata:
   name: subscriptions.messaging.knative.dev
   labels:
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -4722,7 +4738,7 @@ metadata:
   name: triggers.eventing.knative.dev
   labels:
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -4958,7 +4974,7 @@ kind: ClusterRole
 metadata:
   name: addressable-resolver
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -4972,7 +4988,7 @@ metadata:
   name: service-addressable-resolver
   labels:
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -4991,7 +5007,7 @@ metadata:
   name: serving-addressable-resolver
   labels:
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -5013,7 +5029,7 @@ metadata:
   name: channel-addressable-resolver
   labels:
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -5039,7 +5055,7 @@ metadata:
   name: broker-addressable-resolver
   labels:
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -5059,7 +5075,7 @@ metadata:
   name: flows-addressable-resolver
   labels:
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "addressable-resolver" role.
 rules:
@@ -5095,7 +5111,7 @@ kind: ClusterRole
 metadata:
   name: eventing-broker-filter
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5121,7 +5137,7 @@ kind: ClusterRole
 metadata:
   name: eventing-broker-ingress
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5138,7 +5154,7 @@ kind: ClusterRole
 metadata:
   name: eventing-config-reader
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5171,7 +5187,7 @@ kind: ClusterRole
 metadata:
   name: channelable-manipulator
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -5185,7 +5201,7 @@ metadata:
   name: meta-channelable-manipulator
   labels:
     duck.knative.dev/channelable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "channelable-manipulator" role.
 rules:
@@ -5224,7 +5240,7 @@ metadata:
   name: knative-eventing-namespaced-admin
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["eventing.knative.dev"]
@@ -5237,7 +5253,7 @@ metadata:
   name: knative-messaging-namespaced-admin
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["messaging.knative.dev"]
@@ -5250,7 +5266,7 @@ metadata:
   name: knative-flows-namespaced-admin
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["flows.knative.dev"]
@@ -5263,7 +5279,7 @@ metadata:
   name: knative-sources-namespaced-admin
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["sources.knative.dev"]
@@ -5276,7 +5292,7 @@ metadata:
   name: knative-bindings-namespaced-admin
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["bindings.knative.dev"]
@@ -5289,7 +5305,7 @@ metadata:
   name: knative-eventing-namespaced-edit
   labels:
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["eventing.knative.dev", "messaging.knative.dev", "sources.knative.dev", "flows.knative.dev", "bindings.knative.dev"]
@@ -5302,7 +5318,7 @@ metadata:
   name: knative-eventing-namespaced-view
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups: ["eventing.knative.dev", "messaging.knative.dev", "sources.knative.dev", "flows.knative.dev", "bindings.knative.dev"]
@@ -5329,7 +5345,7 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-controller
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5515,6 +5531,67 @@ rules:
       - "patch"
       - "watch"
 
+---
+# Copyright 2024 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Use this aggregated ClusterRole when you need cluster wide crossnamespace subscribe permissions for all resources
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: crossnamespace-subscriber
+  labels:
+    app.kubernetes.io/version: "20240609-844dcbf03"
+    app.kubernetes.io/name: knative-eventing
+aggregationRule:
+  clusterRoleSelectors:
+    - matchLabels:
+        duck.knative.dev/crossnamespace-subscribable: "true"
+rules: [] # rules are automatically filled in by the controller manager.
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: channel-subscriber
+  labels:
+    duck.knative.dev/crossnamespace-subscribable: "true"
+    app.kubernetes.io/version: "20240609-844dcbf03"
+    app.kubernetes.io/name: knative-eventing
+rules:
+  - apiGroups:
+      - messaging.knative.dev
+    resources:
+      - channels
+    verbs:
+      - knsubscribe
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: broker-subscriber
+  labels:
+    duck.knative.dev/crossnamespace-subscribable: "true"
+    app.kubernetes.io/version: "20240609-844dcbf03"
+    app.kubernetes.io/name: knative-eventing
+rules:
+  - apiGroups:
+      - eventing.knative.dev
+    resources:
+      - brokers
+    verbs:
+      - knsubscribe
+
 ---
 # Copyright 2020 The Knative Authors
 #
@@ -5535,7 +5612,7 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-job-sink
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5621,7 +5698,7 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-pingsource-mt-adapter
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5694,7 +5771,7 @@ kind: ClusterRole
 metadata:
   name: podspecable-binding
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -5708,7 +5785,7 @@ metadata:
   name: builtin-podspecable-binding
   labels:
     duck.knative.dev/podspecable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "podspecable-binding role.
 rules:
@@ -5754,7 +5831,7 @@ kind: ClusterRole
 metadata:
   name: source-observer
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 aggregationRule:
   clusterRoleSelectors:
@@ -5768,7 +5845,7 @@ metadata:
   name: eventing-sources-source-observer
   labels:
     duck.knative.dev/source: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # Do not use this role directly. These rules will be added to the "source-observer" role.
 rules:
@@ -5804,7 +5881,7 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-sources-controller
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   - apiGroups:
@@ -5925,7 +6002,7 @@ kind: ClusterRole
 metadata:
   name: knative-eventing-webhook
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   # For watching logging configuration and getting certs.
@@ -6091,7 +6168,7 @@ metadata:
   namespace: knative-eventing
   name: knative-eventing-webhook
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 rules:
   # For manipulating certs into secrets.
@@ -6173,7 +6250,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: config.webhook.eventing.knative.dev
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
@@ -6211,7 +6288,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: webhook.eventing.knative.dev
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
@@ -6244,7 +6321,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   name: validation.webhook.eventing.knative.dev
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
@@ -6278,7 +6355,7 @@ metadata:
   name: eventing-webhook-certs
   namespace: knative-eventing
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 # The data is populated at install time.
 
@@ -6302,7 +6379,7 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: sinkbindings.webhook.sources.knative.dev
   labels:
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 webhooks:
   - admissionReviewVersions: ["v1", "v1beta1"]
diff --git a/third_party/eventing-latest/eventing-crds.yaml b/third_party/eventing-latest/eventing-crds.yaml
index 6369826799..39688260d5 100644
--- a/third_party/eventing-latest/eventing-crds.yaml
+++ b/third_party/eventing-latest/eventing-crds.yaml
@@ -20,7 +20,7 @@ metadata:
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schemas
@@ -307,7 +307,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -510,7 +510,7 @@ metadata:
     knative.dev/crd-install: "true"
     messaging.knative.dev/subscribable: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -856,7 +856,7 @@ metadata:
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   name: containersources.sources.knative.dev
 spec:
@@ -1031,7 +1031,7 @@ metadata:
   name: eventtypes.eventing.knative.dev
   labels:
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev
@@ -1424,7 +1424,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: sinks.knative.dev
@@ -1559,7 +1559,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -2075,7 +2075,7 @@ metadata:
     eventing.knative.dev/source: "true"
     duck.knative.dev/source: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   annotations:
     # TODO add schema
@@ -2447,7 +2447,7 @@ metadata:
   labels:
     knative.dev/crd-install: "true"
     duck.knative.dev/addressable: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: flows.knative.dev
@@ -2819,7 +2819,7 @@ metadata:
     duck.knative.dev/source: "true"
     duck.knative.dev/binding: "true"
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
   name: sinkbindings.sources.knative.dev
 spec:
@@ -3034,7 +3034,7 @@ metadata:
   name: subscriptions.messaging.knative.dev
   labels:
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: messaging.knative.dev
@@ -3296,7 +3296,7 @@ metadata:
   name: triggers.eventing.knative.dev
   labels:
     knative.dev/crd-install: "true"
-    app.kubernetes.io/version: "20240605-bff65d2c2"
+    app.kubernetes.io/version: "20240609-844dcbf03"
     app.kubernetes.io/name: knative-eventing
 spec:
   group: eventing.knative.dev