diff --git a/pkg/infrastructure/cluster.go b/pkg/infrastructure/cluster.go
index 702d6e1ab..844343536 100644
--- a/pkg/infrastructure/cluster.go
+++ b/pkg/infrastructure/cluster.go
@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
diff --git a/webhook/workspace/annotations.go b/webhook/workspace/annotations.go
new file mode 100644
index 000000000..6cb6fa8e0
--- /dev/null
+++ b/webhook/workspace/annotations.go
@@ -0,0 +1,32 @@
+//
+// Copyright (c) 2019-2026 Red Hat, Inc.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package workspace
+
+import (
+	"fmt"
+
+	"github.com/devfile/devworkspace-operator/pkg/infrastructure"
+)
+
+func getWebhookAnnotations(namespace string) map[string]string {
+	annotations := map[string]string{}
+	if infrastructure.IsOpenShift() {
+		annotations["service.beta.openshift.io/inject-cabundle"] = "true"
+	} else {
+		annotations["cert-manager.io/inject-ca-from"] = fmt.Sprintf("%s/devworkspace-controller-serving-cert", namespace)
+	}
+	return annotations
+}
diff --git a/webhook/workspace/annotations_test.go b/webhook/workspace/annotations_test.go
new file mode 100644
index 000000000..6bfb236e3
--- /dev/null
+++ b/webhook/workspace/annotations_test.go
@@ -0,0 +1,39 @@
+//
+// Copyright (c) 2019-2026 Red Hat, Inc.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package workspace
+
+import (
+	"testing"
+
+	"github.com/devfile/devworkspace-operator/pkg/infrastructure"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetWebhookAnnotationsWithOpenShift(t *testing.T) {
+	infrastructure.InitializeForTesting(infrastructure.OpenShiftv4)
+	annotations := getWebhookAnnotations("test-namespace")
+	assert.Equal(t, map[string]string{
+		"service.beta.openshift.io/inject-cabundle": "true",
+	}, annotations)
+}
+
+func TestGetWebhookAnnotationsWithKubernetes(t *testing.T) {
+	infrastructure.InitializeForTesting(infrastructure.Kubernetes)
+	annotations := getWebhookAnnotations("test-namespace")
+	assert.Equal(t, map[string]string{
+		"cert-manager.io/inject-ca-from": "test-namespace/devworkspace-controller-serving-cert",
+	}, annotations)
+}
diff --git a/webhook/workspace/mutating_cfg.go b/webhook/workspace/mutating_cfg.go
index c7433c8c4..6a6e6d143 100644
--- a/webhook/workspace/mutating_cfg.go
+++ b/webhook/workspace/mutating_cfg.go
@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -153,8 +153,9 @@ func BuildMutateWebhookCfg(namespace string) *admregv1.MutatingWebhookConfigurat
 
 	return &admregv1.MutatingWebhookConfiguration{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:   MutateWebhookCfgName,
-			Labels: server.WebhookServerAppLabels(),
+			Name:        MutateWebhookCfgName,
+			Labels:      server.WebhookServerAppLabels(),
+			Annotations: getWebhookAnnotations(namespace),
 		},
 		Webhooks: []admregv1.MutatingWebhook{
 			workspaceMutateWebhook,
diff --git a/webhook/workspace/validating_cfg.go b/webhook/workspace/validating_cfg.go
index 86c22f15b..4c95cad7c 100644
--- a/webhook/workspace/validating_cfg.go
+++ b/webhook/workspace/validating_cfg.go
@@ -1,5 +1,5 @@
 //
-// Copyright (c) 2019-2025 Red Hat, Inc.
+// Copyright (c) 2019-2026 Red Hat, Inc.
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
@@ -34,8 +34,9 @@ func buildValidatingWebhookCfg(namespace string) *admregv1.ValidatingWebhookConf
 	sideEffectsNone := admregv1.SideEffectClassNone
 	return &admregv1.ValidatingWebhookConfiguration{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:   ValidateWebhookCfgName,
-			Labels: server.WebhookServerAppLabels(),
+			Name:        ValidateWebhookCfgName,
+			Labels:      server.WebhookServerAppLabels(),
+			Annotations: getWebhookAnnotations(namespace),
 		},
 		Webhooks: []admregv1.ValidatingWebhook{
 			{