diff --git a/charts/kubeflow-trainer/templates/manager/deployment.yaml b/charts/kubeflow-trainer/templates/manager/deployment.yaml
index 95adf44e04..d5825d3761 100644
--- a/charts/kubeflow-trainer/templates/manager/deployment.yaml
+++ b/charts/kubeflow-trainer/templates/manager/deployment.yaml
@@ -30,6 +30,8 @@ spec:
     metadata:
       labels:
         {{- include "trainer.manager.selectorLabels" . | nindent 8 }}
+      annotations:
+        traffic.sidecar.istio.io/excludeInboundPorts: "9443"
     spec:
       containers:
       - name: manager
diff --git a/manifests/base/manager/manager.yaml b/manifests/base/manager/manager.yaml
index 8f5dc3056c..c028c3dcc2 100644
--- a/manifests/base/manager/manager.yaml
+++ b/manifests/base/manager/manager.yaml
@@ -19,6 +19,8 @@ spec:
         app.kubernetes.io/name: trainer
         app.kubernetes.io/component: manager
         app.kubernetes.io/part-of: kubeflow
+      annotations:
+        traffic.sidecar.istio.io/excludeInboundPorts: "9443"
     spec:
       containers:
         - name: manager
diff --git a/manifests/third-party/jobset/kustomization.yaml b/manifests/third-party/jobset/kustomization.yaml
index c3f0e3ed63..db2c6c8b41 100644
--- a/manifests/third-party/jobset/kustomization.yaml
+++ b/manifests/third-party/jobset/kustomization.yaml
@@ -6,9 +6,25 @@ resources:
 
 # Add required patches.
 patches:
-  # Remove namespace from the JobSet release manifests.
-  - path: patches/jobset_remove_namespace.yaml
-    target:
-      group: ""
-      version: v1
-      kind: Namespace
+# Remove namespace from the JobSet release manifests.
+- path: patches/jobset_remove_namespace.yaml
+  target:
+    group: ""
+    version: v1
+    kind: Namespace
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: jobset-controller-manager
+  patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: jobset-controller-manager
+      namespace: kubeflow-system
+    spec:
+      template:
+        metadata:
+          annotations:
+            traffic.sidecar.istio.io/excludeInboundPorts: "9443"