diff --git a/config/post-install/cleanup.yaml b/config/post-install/cleanup.yaml
index 6563d744c80c..2f87d2a1aca5 100644
--- a/config/post-install/cleanup.yaml
+++ b/config/post-install/cleanup.yaml
@@ -27,13 +27,12 @@ spec:
   backoffLimit: 10
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         app: cleanup-migration-serving
         app.kubernetes.io/name: knative-serving
         app.kubernetes.io/component: cleanup-job
         app.kubernetes.io/version: devel
+        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: controller
       restartPolicy: OnFailure
diff --git a/config/post-install/default-domain.yaml b/config/post-install/default-domain.yaml
index f086550aabe7..aa4b195bdfe9 100644
--- a/config/post-install/default-domain.yaml
+++ b/config/post-install/default-domain.yaml
@@ -25,13 +25,12 @@ metadata:
 spec:
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         app: "default-domain"
         app.kubernetes.io/component: default-domain-job
         app.kubernetes.io/name: knative-serving
         app.kubernetes.io/version: devel
+        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: controller
       containers:
diff --git a/config/post-install/storage-version-migration.yaml b/config/post-install/storage-version-migration.yaml
index b7b0c570801a..0332217fe0c8 100644
--- a/config/post-install/storage-version-migration.yaml
+++ b/config/post-install/storage-version-migration.yaml
@@ -27,13 +27,12 @@ spec:
   backoffLimit: 10
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         app: storage-version-migration-serving
         app.kubernetes.io/name: knative-serving
         app.kubernetes.io/component: storage-version-migration-job
         app.kubernetes.io/version: devel
+        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: controller
       restartPolicy: OnFailure
diff --git a/pkg/reconciler/revision/resources/deploy_test.go b/pkg/reconciler/revision/resources/deploy_test.go
index a74e1f94d95e..b77ed06f638f 100644
--- a/pkg/reconciler/revision/resources/deploy_test.go
+++ b/pkg/reconciler/revision/resources/deploy_test.go
@@ -22,6 +22,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"knative.dev/pkg/kmap"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -48,11 +49,11 @@ import (
 )
 
 var (
-	servingContainerName         = "serving-container"
-	sidecarContainerName         = "sidecar-container-1"
-	sidecarContainerName2        = "sidecar-container-2"
-	sidecarIstioInjectAnnotation = "sidecar.istio.io/inject"
-	defaultServingContainer      = &corev1.Container{
+	servingContainerName    = "serving-container"
+	sidecarContainerName    = "sidecar-container-1"
+	sidecarContainerName2   = "sidecar-container-2"
+	sidecarIstioInjectLabel = "sidecar.istio.io/inject"
+	defaultServingContainer = &corev1.Container{
 		Name:                     servingContainerName,
 		Image:                    "busybox",
 		Ports:                    buildContainerPorts(v1.DefaultUserPort),
@@ -1786,16 +1787,16 @@ func TestMakeDeployment(t *testing.T) {
 			WithContainerStatuses([]v1.ContainerStatus{{
 				ImageDigest: "busybox@sha256:deadbeef",
 			}}),
-			withoutLabels, func(revision *v1.Revision) {
-				revision.Annotations = map[string]string{
-					sidecarIstioInjectAnnotation: "false",
+			func(revision *v1.Revision) {
+				revision.Labels = map[string]string{
+					sidecarIstioInjectLabel: "false",
 				}
 			}),
 		want: appsv1deployment(func(deploy *appsv1.Deployment) {
-			deploy.Annotations = kmeta.UnionMaps(deploy.Annotations,
-				map[string]string{sidecarIstioInjectAnnotation: "false"})
-			deploy.Spec.Template.Annotations = kmeta.UnionMaps(deploy.Spec.Template.Annotations,
-				map[string]string{sidecarIstioInjectAnnotation: "false"})
+			deploy.Labels = kmap.Union(deploy.Labels,
+				map[string]string{sidecarIstioInjectLabel: "false"})
+			deploy.Spec.Template.Labels = kmap.Union(deploy.Spec.Template.Labels,
+				map[string]string{sidecarIstioInjectLabel: "false"})
 		}),
 	}, {
 		name: "with progress-deadline override",
diff --git a/test/config/externaldomaintls/certmanager/http01/mesh-issuer.yaml b/test/config/externaldomaintls/certmanager/http01/mesh-issuer.yaml
index 2a2cfb0d0cb1..e0f7815b30c9 100644
--- a/test/config/externaldomaintls/certmanager/http01/mesh-issuer.yaml
+++ b/test/config/externaldomaintls/certmanager/http01/mesh-issuer.yaml
@@ -26,9 +26,8 @@ spec:
          ingress:
            podTemplate:
             metadata:
-              annotations:
-                sidecar.istio.io/inject: "true"
               labels:
+                sidecar.istio.io/inject: "true"
                 # Istio adds the Challenge name for the value of this label.
                 # And the challenge name is sometimes more than 63 characters.
                 # So we override this label with empty value.
diff --git a/test/e2e/httpproxy.go b/test/e2e/httpproxy.go
index ce5117d6bb01..b80857708851 100644
--- a/test/e2e/httpproxy.go
+++ b/test/e2e/httpproxy.go
@@ -79,9 +79,7 @@ func TestProxyToHelloworld(t *testing.T, clients *test.Clients, helloworldURL *u
 
 	serviceOptions := []rtesting.ServiceOption{
 		rtesting.WithEnv(envVars...),
-		rtesting.WithConfigAnnotations(map[string]string{
-			"sidecar.istio.io/inject": strconv.FormatBool(inject),
-		}),
+		rtesting.WithServiceLabel("sidecar.istio.io/inject", strconv.FormatBool(inject)),
 	}
 
 	resources, err := v1test.CreateServiceReady(t, clients, &names, serviceOptions...)
diff --git a/test/e2e/service_to_service_test.go b/test/e2e/service_to_service_test.go
index 52a25babdaf3..a8a58d90854f 100644
--- a/test/e2e/service_to_service_test.go
+++ b/test/e2e/service_to_service_test.go
@@ -138,13 +138,14 @@ func testSvcToSvcCallViaActivator(t *testing.T, clients *test.Clients, injectA b
 	withInternalVisibility := rtesting.WithServiceLabel(
 		netapi.VisibilityLabelKey, serving.VisibilityClusterLocal)
 
+	withIstioSidecarInject := rtesting.WithServiceLabel("sidecar.istio.io/inject", strconv.FormatBool(injectB))
+
 	test.EnsureTearDown(t, clients, &testNames)
 
 	resources, err := v1test.CreateServiceReady(t, clients, &testNames,
 		rtesting.WithConfigAnnotations(map[string]string{
 			autoscaling.TargetBurstCapacityKey: "-1",
-			"sidecar.istio.io/inject":          strconv.FormatBool(injectB),
-		}), withInternalVisibility)
+		}), withInternalVisibility, withIstioSidecarInject)
 	if err != nil {
 		t.Fatal("Failed to create a service:", err)
 	}