diff --git a/pkg/cluster/cert.go b/pkg/cluster/cert.go
index 12f75329108..46714a9a22f 100644
--- a/pkg/cluster/cert.go
+++ b/pkg/cluster/cert.go
@@ -123,7 +123,7 @@ func generateCertificate(addr string) ([]byte, []byte, error) {
 }
 
 // PropagateDefaultIngressCertificate copies ingress cert secrets from openshift-ingress ns to given namespace.
-func PropagateDefaultIngressCertificate(ctx context.Context, c client.Client, secretName, namespace string) error {
+func PropagateDefaultIngressCertificate(ctx context.Context, c client.Client, secretName, namespace string, metaOptions ...MetaOptions) error {
 	// Add IngressController to scheme
 	runtime.Must(operatorv1.Install(c.Scheme()))
 	defaultIngressCtrl, err := FindAvailableIngressController(ctx, c)
@@ -138,6 +138,9 @@ func PropagateDefaultIngressCertificate(ctx context.Context, c client.Client, se
 		return err
 	}
 
+	if err := ApplyMetaOptions(defaultIngressSecret, metaOptions...); err != nil {
+		return err
+	}
 	return copySecretToNamespace(ctx, c, defaultIngressSecret, secretName, namespace)
 }
 
@@ -170,8 +173,9 @@ func GetSecret(ctx context.Context, c client.Client, namespace, name string) (*c
 func copySecretToNamespace(ctx context.Context, c client.Client, secret *corev1.Secret, newSecretName, namespace string) error {
 	newSecret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      newSecretName,
-			Namespace: namespace,
+			Name:            newSecretName,
+			Namespace:       namespace,
+			OwnerReferences: secret.OwnerReferences,
 		},
 		Data: secret.Data,
 		Type: secret.Type,
diff --git a/pkg/feature/serverless/resources.go b/pkg/feature/serverless/resources.go
index cc28390895d..2d27f8f99c6 100644
--- a/pkg/feature/serverless/resources.go
+++ b/pkg/feature/serverless/resources.go
@@ -25,7 +25,7 @@ func ServingCertificateResource(ctx context.Context, f *feature.Feature) error {
 	case infrav1.Provided:
 		return nil
 	default:
-		return cluster.PropagateDefaultIngressCertificate(ctx, f.Client, secretData.Name, secretData.Namespace)
+		return cluster.PropagateDefaultIngressCertificate(ctx, f.Client, secretData.Name, secretData.Namespace, feature.DefaultMetaOptions(f)...)
 	}
 }