diff --git a/pkg/reconciler/revision/controller.go b/pkg/reconciler/revision/controller.go
index 3a8db9f1919d..614707b6d6ed 100644
--- a/pkg/reconciler/revision/controller.go
+++ b/pkg/reconciler/revision/controller.go
@@ -26,6 +26,7 @@ import (
 	"golang.org/x/time/rate"
 	cachingclient "knative.dev/caching/pkg/client/injection/client"
 	imageinformer "knative.dev/caching/pkg/client/injection/informers/caching/v1alpha1/image"
+	"knative.dev/networking/pkg/apis/networking/v1alpha1"
 	networkingclient "knative.dev/networking/pkg/client/injection/client"
 	certificateinformer "knative.dev/networking/pkg/client/injection/informers/networking/v1alpha1/certificate"
 	"knative.dev/pkg/changeset"
@@ -108,6 +109,8 @@ func newControllerWithOptions(
 		return controller.Options{ConfigStore: configStore}
 	})
 
+	c.tracker = impl.Tracker
+
 	transport := http.DefaultTransport
 	if rt, err := newResolverTransport(k8sCertPath, digestResolutionWorkers, digestResolutionWorkers); err != nil {
 		logging.FromContext(ctx).Errorw("Failed to create resolver transport", zap.Error(err))
@@ -136,7 +139,15 @@ func newControllerWithOptions(
 	}
 	deploymentInformer.Informer().AddEventHandler(handleMatchingControllers)
 	paInformer.Informer().AddEventHandler(handleMatchingControllers)
-	certificateInformer.Informer().AddEventHandler(handleMatchingControllers)
+	certificateInformer.Informer().AddEventHandler(controller.HandleAll(
+		// Call the tracker's OnChanged method, but we've seen the objects
+		// coming through this path missing TypeMeta, so ensure it is properly
+		// populated.
+		controller.EnsureTypeMeta(
+			c.tracker.OnChanged,
+			v1alpha1.SchemeGroupVersion.WithKind("Certificate"),
+		),
+	))
 
 	// We don't watch for changes to Image because we don't incorporate any of its
 	// properties into our own status and should work completely in the absence of
diff --git a/pkg/reconciler/revision/reconcile_resources.go b/pkg/reconciler/revision/reconcile_resources.go
index 13280f17a515..eccad1c72543 100644
--- a/pkg/reconciler/revision/reconcile_resources.go
+++ b/pkg/reconciler/revision/reconcile_resources.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 
 	"go.uber.org/zap"
+	"knative.dev/pkg/tracker"
 	networkingaccessor "knative.dev/serving/pkg/reconciler/accessor/networking"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -229,7 +230,7 @@ func (c *Reconciler) reconcileQueueProxyCertificate(ctx context.Context, rev *v1
 	}
 
 	desiredCert := resources.MakeQueueProxyCertificate(owningNs, certClass)
-	_, err = networkingaccessor.ReconcileCertificate(ctx, owningNs, desiredCert, c)
+	cert, err := networkingaccessor.ReconcileCertificate(ctx, owningNs, desiredCert, c)
 	if err != nil {
 		return fmt.Errorf("failed to reconcile Knative certificate %s/%s: %w", ns, networking.ServingCertName, err)
 	}
@@ -249,5 +250,17 @@ func (c *Reconciler) reconcileQueueProxyCertificate(ctx context.Context, rev *v1
 		return fmt.Errorf("certificate in secret %s/%s is not ready yet: private key not found", ns, networking.ServingCertName)
 	}
 
+	// Tell our trackers to reconcile Revisions when the KnativeCertificate changes
+	gvk := cert.GetGroupVersionKind()
+	apiVersion, kind := gvk.ToAPIVersionAndKind()
+	if err := c.tracker.TrackReference(tracker.Reference{
+		APIVersion: apiVersion,
+		Kind:       kind,
+		Namespace:  cert.GetNamespace(),
+		Name:       cert.GetName(),
+	}, rev); err != nil {
+		return err
+	}
+
 	return nil
 }
diff --git a/pkg/reconciler/revision/revision.go b/pkg/reconciler/revision/revision.go
index 9ad45efbb911..47c0fa2d6bc8 100644
--- a/pkg/reconciler/revision/revision.go
+++ b/pkg/reconciler/revision/revision.go
@@ -32,6 +32,7 @@ import (
 	appsv1listers "k8s.io/client-go/listers/apps/v1"
 	cachingclientset "knative.dev/caching/pkg/client/clientset/versioned"
 	networkingclientset "knative.dev/networking/pkg/client/clientset/versioned"
+	"knative.dev/pkg/tracker"
 	clientset "knative.dev/serving/pkg/client/clientset/versioned"
 
 	revisionreconciler "knative.dev/serving/pkg/client/injection/reconciler/serving/v1/revision"
@@ -66,6 +67,7 @@ type Reconciler struct {
 	deploymentLister    appsv1listers.DeploymentLister
 	certificateLister   networkinglisters.CertificateLister
 
+	tracker  tracker.Interface
 	resolver resolver
 }