diff --git a/.github/workflows/update-istio-operator.yml b/.github/workflows/update-istio-operator.yml
new file mode 100644
index 000000000000..255bac417f3c
--- /dev/null
+++ b/.github/workflows/update-istio-operator.yml
@@ -0,0 +1,49 @@
+name: "update-istio-operator-version"
+on:
+  workflow_dispatch:
+  schedule:
+    # every Monday at around 3 am pacific/10 am UTC
+    - cron: "0 10 * * 1"
+env:
+  GOPROXY: https://proxy.golang.org
+  GO_VERSION: '1.21.1'
+permissions:
+  contents: read
+
+jobs:
+  bump-istio-operator-version:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe
+        with:
+          go-version: ${{env.GO_VERSION}}
+          cache-dependency-path: ./go.sum
+      - name: Bump istio-operator version
+        id: bumpIstioOperator
+        run: |
+          echo "OLD_VERSION=$(DEP=istio-operator make get-dependency-version)" >> $GITHUB_OUTPUT
+          make update-istio-operator-version
+          echo "NEW_VERSION=$(DEP=istio-operator make get-dependency-version)" >> $GITHUB_OUTPUT
+          # The following is to support multiline with GITHUB_OUTPUT, see https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
+          echo "changes<<EOF" >> $GITHUB_OUTPUT
+          echo "$(git status --porcelain)" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+      - name: Create PR
+        if: ${{ steps.bumpIstioOperator.outputs.changes != '' }}
+        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38
+        with:
+          token: ${{ secrets.MINIKUBE_BOT_PAT }}
+          commit-message: 'Addon istio-provisioner: Update istio/operator image from ${{ steps.bumpIstioOperator.outputs.OLD_VERSION }} to ${{ steps.bumpIstioOperator.outputs.NEW_VERSION }}'
+          committer: minikube-bot <minikube-bot@google.com>
+          author: minikube-bot <minikube-bot@google.com>
+          branch: auto_bump_istio_operator_version
+          push-to-fork: minikube-bot/minikube
+          base: master
+          delete-branch: true
+          title: 'Addon istio-provisioner: Update istio/operator image from ${{ steps.bumpIstioOperator.outputs.OLD_VERSION }} to ${{ steps.bumpIstioOperator.outputs.NEW_VERSION }}'
+          labels: ok-to-test
+          body: |
+            The [istio](https://github.com/istio/istio) project released a new istio/operator image
+
+            This PR was auto-generated by `make update-istio-operator-version` using [update-istio-operator-version.yml](https://github.com/kubernetes/minikube/tree/master/.github/workflows/update-istio-operator-version.yml) CI Workflow.
diff --git a/Makefile b/Makefile
index cb6e8c1a507c..2d2d3e2f1ea4 100644
--- a/Makefile
+++ b/Makefile
@@ -1170,6 +1170,11 @@ update-kindnetd-version:
 	(cd hack/update/kindnetd_version && \
 	 go run update_kindnetd_version.go)
 
+.PHONY: update-istio-operator-version
+update-istio-operator-version:
+	(cd hack/update/istio_operator_version && \
+	 go run update_istio_operator_version.go)
+
 .PHONY: get-dependency-verison
 get-dependency-version:
 	@(cd hack/update/get_version && \
diff --git a/hack/update/get_version/get_version.go b/hack/update/get_version/get_version.go
index d09a62dc40e3..e350d8ab5323 100644
--- a/hack/update/get_version/get_version.go
+++ b/hack/update/get_version/get_version.go
@@ -50,6 +50,7 @@ var dependencies = map[string]dependency{
 	"hugo":             {"netlify.toml", `HUGO_VERSION = "(.*)"`},
 	"ingress":          {addonsFile, `ingress-nginx/controller:(.*)@`},
 	"inspektor-gadget": {addonsFile, `inspektor-gadget/inspektor-gadget:(.*)@`},
+	"istio-operator":   {addonsFile, `istio/operator:(.*)@`},
 	"kindnetd":         {"pkg/minikube/bootstrapper/images/images.go", `kindnetd:(.*)"`},
 	"metrics-server":   {addonsFile, `metrics-server/metrics-server:(.*)@`},
 	"nerdctl":          {"deploy/kicbase/Dockerfile", `NERDCTL_VERSION="(.*)"`},
diff --git a/hack/update/github.go b/hack/update/github.go
index 8c7fde93055f..050046198136 100644
--- a/hack/update/github.go
+++ b/hack/update/github.go
@@ -48,38 +48,47 @@ func GHReleases(ctx context.Context, owner, repo string) (stable, latest, edge R
 	// walk through the paginated list of up to ghSearchLimit newest releases
 	opts := &github.ListOptions{PerPage: ghListPerPage}
 	for (opts.Page+1)*ghListPerPage <= ghSearchLimit {
-		rls, resp, err := ghc.Repositories.ListReleases(ctx, owner, repo, opts)
+		rls, resp, err := ghc.Repositories.ListTags(ctx, owner, repo, opts)
 		if err != nil {
 			return stable, latest, edge, err
 		}
 		for _, rl := range rls {
-			ver := rl.GetTagName()
+			ver := rl.GetName()
+			commit := rl.GetCommit().GetSHA()
 			if !semver.IsValid(ver) {
-				continue
+				ver = fmt.Sprintf("v%s", ver)
+				if !semver.IsValid(ver) {
+					continue
+				}
 			}
 			// check if ver version is release (ie, 'v1.19.2') or pre-release (ie, 'v1.19.3-rc.0' or 'v1.19.0-beta.2')
 			prerls := semver.Prerelease(ver)
 			if prerls == "" {
 				if semver.Compare(ver, stable.Tag) == 1 {
 					stable.Tag = ver
+					stable.Commit = commit
 				}
 			} else if strings.HasPrefix(prerls, "-rc") || strings.HasPrefix(prerls, "-beta") {
 				if semver.Compare(ver, latest.Tag) == 1 {
 					latest.Tag = ver
+					latest.Commit = commit
 				}
 			} else if strings.Contains(prerls, "-alpha") {
 				if semver.Compare(ver, edge.Tag) == 1 {
 					edge.Tag = ver
+					edge.Commit = commit
 				}
 			}
 
 			// make sure that latest >= stable
 			if semver.Compare(latest.Tag, stable.Tag) == -1 {
 				latest.Tag = stable.Tag
+				latest.Commit = stable.Commit
 			}
 			// make sure that edge >= latest
 			if semver.Compare(edge.Tag, latest.Tag) == -1 {
 				edge.Tag = latest.Tag
+				edge.Commit = latest.Commit
 			}
 		}
 		if resp.NextPage == 0 {
@@ -87,41 +96,8 @@ func GHReleases(ctx context.Context, owner, repo string) (stable, latest, edge R
 		}
 		opts.Page = resp.NextPage
 	}
-	// create a map where the key is the tag and the values is an array of releases (stable, latest, edge) that match the tag
-	releasesWithoutCommits := map[string][]*Release{}
-	for _, rl := range []*Release{&stable, &latest, &edge} {
-		releasesWithoutCommits[rl.Tag] = append(releasesWithoutCommits[rl.Tag], rl)
-	}
-	// run though the releases to find ones that don't yet have a commit and assign it
-	opts = &github.ListOptions{PerPage: ghListPerPage}
-	for (opts.Page+1)*ghListPerPage <= ghSearchLimit {
-		tags, resp, err := ghc.Repositories.ListTags(ctx, owner, repo, opts)
-		if err != nil {
-			return stable, latest, edge, err
-		}
-		for _, tag := range tags {
-			rls, ok := releasesWithoutCommits[*tag.Name]
-			if !ok {
-				continue
-			}
-			for _, rl := range rls {
-				rl.Commit = *tag.Commit.SHA
-			}
-			delete(releasesWithoutCommits, *tag.Name)
-			if len(releasesWithoutCommits) == 0 {
-				return stable, latest, edge, nil
-			}
-		}
-		if len(releasesWithoutCommits) == 0 {
-			break
-		}
-		if resp.NextPage == 0 {
-			break
-		}
-		opts.Page = resp.NextPage
-	}
 
-	return stable, latest, edge, fmt.Errorf("wasn't able to find commit for releases")
+	return stable, latest, edge, nil
 }
 
 func StableVersion(ctx context.Context, owner, repo string) (string, error) {
diff --git a/hack/update/istio_operator_version/update_istio_operator_version.go b/hack/update/istio_operator_version/update_istio_operator_version.go
new file mode 100644
index 000000000000..ed8c4a198f9d
--- /dev/null
+++ b/hack/update/istio_operator_version/update_istio_operator_version.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2023 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"k8s.io/klog/v2"
+	"k8s.io/minikube/hack/update"
+)
+
+var schema = map[string]update.Item{
+	"pkg/minikube/assets/addons.go": {
+		Replace: map[string]string{
+			`istio/operator:.*`: `istio/operator:{{.Version}}@{{.SHA}}",`,
+		},
+	},
+}
+
+type Data struct {
+	Version string
+	SHA     string
+}
+
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	stable, _, _, err := update.GHReleases(ctx, "istio", "istio")
+	if err != nil {
+		klog.Fatalf("Unable to get stable version: %v", err)
+	}
+	version := strings.TrimPrefix(stable.Tag, "v")
+	sha, err := update.GetImageSHA(fmt.Sprintf("docker.io/istio/operator:%s", version))
+	if err != nil {
+		klog.Fatalf("failed to get image SHA: %v", err)
+	}
+
+	data := Data{Version: version, SHA: sha}
+
+	update.Apply(schema, data)
+}