diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 10d1279af3..672704c970 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -8,7 +8,7 @@ aliases:
     - wallrj
     - jakexks
     - maelvls
-    - irbekrm
     - sgtcodfish
     - inteon
     - thatsmrtalbot
+    - erikgb
diff --git a/klone.yaml b/klone.yaml
index 4b26df92fc..e79d5819e1 100644
--- a/klone.yaml
+++ b/klone.yaml
@@ -10,30 +10,30 @@ targets:
     - folder_name: boilerplate
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: c775b91913708e2ea4816373d0b0b4b632b3b524
+      repo_hash: 67e71b61af17a44f8f619394d79d343134086e40
       repo_path: modules/boilerplate
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: c775b91913708e2ea4816373d0b0b4b632b3b524
+      repo_hash: 67e71b61af17a44f8f619394d79d343134086e40
       repo_path: modules/generate-verify
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: c775b91913708e2ea4816373d0b0b4b632b3b524
+      repo_hash: 67e71b61af17a44f8f619394d79d343134086e40
       repo_path: modules/help
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: c775b91913708e2ea4816373d0b0b4b632b3b524
+      repo_hash: 67e71b61af17a44f8f619394d79d343134086e40
       repo_path: modules/klone
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: c775b91913708e2ea4816373d0b0b4b632b3b524
+      repo_hash: 67e71b61af17a44f8f619394d79d343134086e40
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: c775b91913708e2ea4816373d0b0b4b632b3b524
+      repo_hash: 67e71b61af17a44f8f619394d79d343134086e40
       repo_path: modules/tools
diff --git a/make/_shared/repository-base/base/OWNERS_ALIASES b/make/_shared/repository-base/base/OWNERS_ALIASES
index 10d1279af3..672704c970 100644
--- a/make/_shared/repository-base/base/OWNERS_ALIASES
+++ b/make/_shared/repository-base/base/OWNERS_ALIASES
@@ -8,7 +8,7 @@ aliases:
     - wallrj
     - jakexks
     - maelvls
-    - irbekrm
     - sgtcodfish
     - inteon
     - thatsmrtalbot
+    - erikgb
diff --git a/make/_shared/tools/00_mod.mk b/make/_shared/tools/00_mod.mk
index 43cbc6b71a..1543ae00aa 100644
--- a/make/_shared/tools/00_mod.mk
+++ b/make/_shared/tools/00_mod.mk
@@ -75,6 +75,8 @@ tools += trivy=v0.54.1
 tools += ytt=v0.50.0
 # https://github.com/rclone/rclone/releases
 tools += rclone=v1.67.0
+# https://github.com/istio/istio/releases
+tools += istioctl=1.24.0
 
 ### go packages
 # https://pkg.go.dev/sigs.k8s.io/controller-tools/cmd/controller-gen?tab=versions
@@ -580,6 +582,22 @@ $(DOWNLOAD_DIR)/tools/rclone@$(RCLONE_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWN
 		chmod +x $(outfile); \
 		rm -f $(outfile).zip
 
+istioctl_linux_amd64_SHA256SUM=b6a07dfb3112f24b174c92bb23b71ba2373114d04e70f079b45cf7c46943ca7e
+istioctl_linux_arm64_SHA256SUM=25b44d36f91337545cddd342e4ccc5686dd8f283916d4eaf0d9efdfe84bd057f
+istioctl_darwin_amd64_SHA256SUM=00b0f321c1e300465a10584e6f4ffa362ff4b11ee655e94dd8985d61c808a16f
+istioctl_darwin_arm64_SHA256SUM=21ece4d2882decccc2ed3f14df078f1fc9fccc3048a7e65371a84d7aabce1912
+
+.PRECIOUS: $(DOWNLOAD_DIR)/tools/istioctl@$(ISTIOCTL_VERSION)_$(HOST_OS)_$(HOST_ARCH)
+$(DOWNLOAD_DIR)/tools/istioctl@$(ISTIOCTL_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD_DIR)/tools
+	$(eval OS := $(subst darwin,osx,$(HOST_OS)))
+
+	@source $(lock_script) $@; \
+		$(CURL) https://github.com/istio/istio/releases/download/$(ISTIOCTL_VERSION)/istio-$(ISTIOCTL_VERSION)-$(OS)-$(HOST_ARCH).tar.gz -o $(outfile).tar.gz; \
+		$(checkhash_script) $(outfile).tar.gz $(istioctl_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM); \
+		tar xfO $(outfile).tar.gz istio-$(ISTIOCTL_VERSION)/bin/istioctl > $(outfile); \
+		chmod +x $(outfile); \
+		rm $(outfile).tar.gz
+
 preflight_linux_amd64_SHA256SUM=97750df31f31200f073e3b2844628a0a3681a403648c76d12319f83c80666104
 preflight_linux_arm64_SHA256SUM=e12b2afe063c07ee75f69f285f8cc56be99b85e2abac99cbef5fb22b91ef0cb7