diff --git a/Makefile b/Makefile
index fd9591b9..2e57be3e 100644
--- a/Makefile
+++ b/Makefile
@@ -242,7 +242,7 @@ dev-setup-argocd: dev-setup-fluxcd
 	@printf "  \033[1mkubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d\033[0m\n\n"
 	@printf "  \033[1mkubectl port-forward svc/argocd-server 9091:80 -n argocd\033[0m\n\n"
 
-dev-setup-cert-manager: dev-setup-fluxcd
+dev-setup-cert-manager:
 	@$(KUBECTL) kustomize --load-restrictor='LoadRestrictionsNone' hack/distro/cert-manager | envsubst | kubectl apply -f -
 
 dev-setup-fluxcd:
@@ -261,7 +261,7 @@ dev-setup-capsule: dev-setup-fluxcd
 	@$(MAKE) wait-for-helmreleases
 	@$(MAKE) dev-setup-capsule-example
 
-dev-setup-capsule-example:
+dev-setup-capsule-example: dev-setup-fluxcd
 	@$(KUBECTL) kustomize --load-restrictor='LoadRestrictionsNone' hack/distro/capsule/example-setup | envsubst | kubectl apply -f -
 	@$(KUBECTL) create ns wind-uat --as joe --as-group projectcapsule.dev || true
 	@$(KUBECTL) label ns wind-uat env=test
diff --git a/e2e/custom_resource_quota_test.go b/e2e/custom_resource_quota_test.go
index d9300a98..2a155f64 100644
--- a/e2e/custom_resource_quota_test.go
+++ b/e2e/custom_resource_quota_test.go
@@ -106,7 +106,7 @@ var _ = Describe("when Tenant limits custom Resource Quota", Ordered, Label("res
 		EventuallyDeletion(tnt)
 	})
 
-	It("should block resources in overflow", func() {
+	It("should block resources in overflow", Label("skip-on-openshift"), func() {
 		dynamicClient := dynamic.NewForConfigOrDie(cfg)
 
 		for _, i := range []int{1, 2, 3} {
diff --git a/e2e/customquota_global_test.go b/e2e/customquota_global_test.go
index 742e8e0a..eb9a63fb 100644
--- a/e2e/customquota_global_test.go
+++ b/e2e/customquota_global_test.go
@@ -211,7 +211,7 @@ func getLedger(ctx context.Context, namespace, name string) *capsulev1beta2.Quan
 	return obj
 }
 
-var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ordered, Label("global", "globalcustomquota", "customquota", "ledger"), Ordered, func() {
+var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ordered, Label("global", "globalcustomquota", "customquota", "ledger", "skip-on-openshift"), Ordered, func() {
 	const (
 		testNamespace = "global-custom-quota-e2e-test"
 		tenantLabel   = "e2e.capsule.dev/test-suite"
@@ -316,7 +316,7 @@ var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ord
 		}
 	})
 
-	It("aggregates a custom pod quantity path and settles the corresponding ledger", func() {
+	It("aggregates a custom pod quantity path and settles the corresponding ledger", Label("skip-on-openshift"), func() {
 		q := &capsulev1beta2.GlobalCustomQuota{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "gq-pod-cpu-requests",
@@ -440,7 +440,7 @@ var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ord
 		}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
 	})
 
-	It("denies creating a matching object when the configured quantity path resolves to no value", func() {
+	It("denies creating a matching object when the configured quantity path resolves to no value", Label("skip-on-openshift"), func() {
 		q := &capsulev1beta2.GlobalCustomQuota{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "gq-missing-path-deny-create",
@@ -492,7 +492,7 @@ var _ = Describe("when GlobalCustomQuota uses ledger-backed reconciliation", Ord
 		expectLedgerSettled(ctx, ControllerNamespace, q.GetName())
 	})
 
-	It("remains consistent under concurrent pod creations for a GlobalCustomQuota", func() {
+	It("remains consistent under concurrent pod creations for a GlobalCustomQuota", Label("skip-on-openshift"), func() {
 		q := &capsulev1beta2.GlobalCustomQuota{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "gq-concurrent-pod-count",
diff --git a/e2e/customquota_namespaced_test.go b/e2e/customquota_namespaced_test.go
index 43d3b3b6..f833e5d5 100644
--- a/e2e/customquota_namespaced_test.go
+++ b/e2e/customquota_namespaced_test.go
@@ -20,7 +20,7 @@ import (
 	"k8s.io/client-go/kubernetes/scheme"
 )
 
-var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered, Label("namespaced", "namespacedcustomquota", "customquota", "ledger"), Ordered, func() {
+var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered, Label("namespaced", "namespacedcustomquota", "customquota", "ledger", "skip-on-openshift"), Ordered, func() {
 	const (
 		testNamespace = "custom-quota-e2e-test"
 		tenantLabel   = "e2e.capsule.dev/test-suite"
@@ -136,7 +136,7 @@ var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered,
 		}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
 	})
 
-	It("denies creating a matching object when the configured quantity path resolves to no value", func() {
+	It("denies creating a matching object when the configured quantity path resolves to no value", Label("skip-on-openshift"), func() {
 		q := &capsulev1beta2.CustomQuota{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "cq-missing-path-deny-create",
@@ -178,7 +178,7 @@ var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered,
 		expectLedgerSettled(ctx, testNamespace, q.GetName())
 	})
 
-	It("remains consistent under concurrent pod creations for a CustomQuota", func() {
+	It("remains consistent under concurrent pod creations for a CustomQuota", Label("skip-on-openshift"), func() {
 		q := &capsulev1beta2.CustomQuota{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "cq-concurrent-pod-count",
@@ -261,7 +261,7 @@ var _ = Describe("when CustomQuota uses ledger-backed reconciliation", Ordered,
 		expectLedgerSettled(ctx, testNamespace, q.GetName())
 	})
 
-	It("tracks different paths independently when global and namespaced quotas match the same pod gvk", func() {
+	It("tracks different paths independently when global and namespaced quotas match the same pod gvk", Label("skip-on-openshift"), func() {
 		gq := &capsulev1beta2.GlobalCustomQuota{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "gq-mixed-path-cpu-from-cq-suite",
diff --git a/e2e/namespace_capsule_label_test.go b/e2e/namespace_capsule_label_test.go
index c78b483e..0fc99d60 100644
--- a/e2e/namespace_capsule_label_test.go
+++ b/e2e/namespace_capsule_label_test.go
@@ -51,7 +51,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("nam
 		EventuallyDeletion(tnt)
 	})
 
-	It("should contains the default Capsule label", func() {
+	It("should contains the default Capsule label", Label("skip-on-openshift"), func() {
 		namespaces := []*v1.Namespace{
 			NewNamespace("", map[string]string{
 				meta.TenantLabel: tnt.GetName(),
diff --git a/e2e/namespace_metadata_forbidden_test.go b/e2e/namespace_metadata_forbidden_test.go
index 9c1dca49..4c26765b 100644
--- a/e2e/namespace_metadata_forbidden_test.go
+++ b/e2e/namespace_metadata_forbidden_test.go
@@ -257,7 +257,7 @@ var _ = Describe("creating a Namespace with user-specified labels and annotation
 		})
 	})
 
-	It("should fail when updating a Namespace", func() {
+	It("should fail when updating a Namespace", Label("skip-on-openshift"), func() {
 		role := &rbacv1.Role{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "ns-patch",
diff --git a/e2e/performance_scalability_test.go b/e2e/performance_scalability_test.go
index 49d69f1c..1e16a242 100644
--- a/e2e/performance_scalability_test.go
+++ b/e2e/performance_scalability_test.go
@@ -50,7 +50,7 @@ var _ = Describe("verify scalability", Ordered, Label("performance", "scalabilit
 		EventuallyDeletion(tnt)
 	})
 
-	It("verify lifecycle (scalability)", func() {
+	It("verify lifecycle (scalability)", Label("skip-on-openshift"), func() {
 		const amount = 50
 		const podsPerNamespace int32 = 1
 
diff --git a/e2e/replications_globaltenantresource_test.go b/e2e/replications_globaltenantresource_test.go
index 2abe7558..193f651b 100644
--- a/e2e/replications_globaltenantresource_test.go
+++ b/e2e/replications_globaltenantresource_test.go
@@ -252,7 +252,7 @@ var _ = Describe("GlobalTenantResource", Ordered, Label("replications", "global"
 			expectGlobalTenantResourceProcessedClusterRole("gtr-cluster-generator", "gtr-cluster-generator-role")
 		})
 
-		It("only allows the managing GlobalTenantResource service account to update created cluster-scoped objects", func() {
+		It("only allows the managing GlobalTenantResource service account to update created cluster-scoped objects", Label("skip-on-openshift"), func() {
 			saName := "gtr-cluster-update-guard"
 			clusterRoleName := "gtr-cluster-admission-role"
 			writerRoleName := "gtr-cluster-admission-writer"
@@ -834,7 +834,7 @@ data:
 			}
 		})
 
-		It("only allows the managing GlobalTenantResource service account to update created objects", func() {
+		It("only allows the managing GlobalTenantResource service account to update created objects", Label("skip-on-openshift"), func() {
 			saName := "gtr-update-guard"
 			targetNamespace := tenantANamespaces[0]
 			configMapName := "gtr-admission-protected"
@@ -903,7 +903,7 @@ data:
 			}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
 		})
 
-		It("fails to prune replicated resources when the impersonated service account cannot delete them", func() {
+		It("fails to prune replicated resources when the impersonated service account cannot delete them", Label("skip-on-openshift"), func() {
 			saCreate := "gtr-creator-ok"
 			saNoDelete := "gtr-creator-no-delete"
 
@@ -1047,7 +1047,7 @@ data:
 		})
 	})
 
-	Context("prune on selector drift", func() {
+	Context("prune on selector drift", Label("skip-on-openshift"), func() {
 		It("prunes objects from tenants that stop matching tenantSelector", func() {
 			gtr := newRawConfigMapGlobalTenantResource("gtr-tenant-selector-prune", map[string]string{
 				"mode": "both",
diff --git a/e2e/replications_tenantresource_test.go b/e2e/replications_tenantresource_test.go
index 675a9d45..80bde60e 100644
--- a/e2e/replications_tenantresource_test.go
+++ b/e2e/replications_tenantresource_test.go
@@ -958,7 +958,7 @@ data:
 	})
 
 	Context("apply lifecycle with prune enabled", func() {
-		It("applies, updates and prunes raw items", func() {
+		It("applies, updates and prunes raw items", Label("skip-on-openshift"), func() {
 			tr := newRawConfigMapTenantResource(baseNamespace, "raw-prune-enabled", map[string]string{
 				"mode": "before",
 				"foo":  "one",
diff --git a/e2e/rules_enforce_metadata_test.go b/e2e/rules_enforce_metadata_test.go
index ceb2ac62..5f59c734 100644
--- a/e2e/rules_enforce_metadata_test.go
+++ b/e2e/rules_enforce_metadata_test.go
@@ -858,7 +858,7 @@ var _ = Describe("enforcing generic metadata namespace rules", Ordered, Label("t
 		)
 	})
 
-	It("treats empty apiVersion as core v1 and does not match grouped resources", func() {
+	It("treats empty apiVersion as core v1 and does not match grouped resources", Label("skip-on-openshift"), func() {
 		updateTenantRules([]*rules.NamespaceRuleBodyTenant{
 			metadataRule(
 				rules.ActionTypeAllow,
diff --git a/e2e/rules_enforce_qos_test.go b/e2e/rules_enforce_qos_test.go
index 0ac1fce6..24a7368a 100644
--- a/e2e/rules_enforce_qos_test.go
+++ b/e2e/rules_enforce_qos_test.go
@@ -512,7 +512,7 @@ var _ = Describe("enforcing pod QoS namespace rules", Ordered, Label("tenant", "
 		)
 	})
 
-	It("computes QoS across init containers and regular containers", func() {
+	It("computes QoS across init containers and regular containers", Label("skip-on-openshift"), func() {
 		ns := NewNamespace("", map[string]string{
 			meta.TenantLabel: tnt.GetName(),
 		})
diff --git a/e2e/service_allowed_external_ips_test.go b/e2e/service_allowed_external_ips_test.go
index 9df10d3b..a7e89b69 100644
--- a/e2e/service_allowed_external_ips_test.go
+++ b/e2e/service_allowed_external_ips_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/projectcapsule/capsule/pkg/api/rbac"
 )
 
-var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, Label("tenant", "networking", "service"), func() {
+var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, Label("tenant", "networking", "service", "skip-on-openshift"), func() {
 	tnt := &capsulev1beta2.Tenant{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "e2e-allowed-external-ip",
@@ -95,7 +95,7 @@ var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, La
 		}).ShouldNot(Succeed())
 	})
 
-	It("should allow the first CIDR block", Label("skip-on-openshift"), func() {
+	It("should allow the first CIDR block", func() {
 		ns := NewNamespace("", map[string]string{
 			meta.TenantLabel: tnt.GetName(),
 		})
@@ -132,7 +132,7 @@ var _ = Describe("enforcing an allowed set of Service external IPs", Ordered, La
 		}).Should(Succeed())
 	})
 
-	It("should allow the /32 CIDR block", Label("skip-on-openshift"), func() {
+	It("should allow the /32 CIDR block", func() {
 		ns := NewNamespace("", map[string]string{
 			meta.TenantLabel: tnt.GetName(),
 		})
diff --git a/e2e/service_forbidden_metadata_test.go b/e2e/service_forbidden_metadata_test.go
index 2e39afb4..4cc4d5f3 100644
--- a/e2e/service_forbidden_metadata_test.go
+++ b/e2e/service_forbidden_metadata_test.go
@@ -18,7 +18,7 @@ import (
 	"github.com/projectcapsule/capsule/pkg/api/rbac"
 )
 
-var _ = Describe("creating a Service with user-specified labels and annotations", Ordered, Label("tenant", "networking", "service"), func() {
+var _ = Describe("creating a Service with user-specified labels and annotations", Ordered, Label("tenant", "networking", "service", "skip-on-openshift"), func() {
 	tnt := &capsulev1beta2.Tenant{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "e2e-service-user-metadata-forbidden",
diff --git a/e2e/storage_pv_cross_tenant_mount_test.go b/e2e/storage_pv_cross_tenant_mount_test.go
index af87b5e5..d4f0d4c5 100644
--- a/e2e/storage_pv_cross_tenant_mount_test.go
+++ b/e2e/storage_pv_cross_tenant_mount_test.go
@@ -81,7 +81,7 @@ var _ = Describe("preventing PersistentVolume cross-tenant mount", Ordered, Labe
 		}
 	})
 
-	It("should add labels to PersistentVolume and prevent cross-Tenant mount", func() {
+	It("should add labels to PersistentVolume and prevent cross-Tenant mount", Label("skip-on-openshift"), func() {
 		ns := NewNamespace("", map[string]string{
 			meta.TenantLabel: tnt1.GetName(),
 		})
diff --git a/e2e/tenant_resource_quota_exceeded_test.go b/e2e/tenant_resource_quota_exceeded_test.go
index 42a19237..d15e0646 100644
--- a/e2e/tenant_resource_quota_exceeded_test.go
+++ b/e2e/tenant_resource_quota_exceeded_test.go
@@ -138,7 +138,7 @@ var _ = Describe("exceeding a Tenant resource quota", Ordered, Label("resourcequ
 		EventuallyDeletion(tnt)
 	})
 
-	It("should block new Pods", func() {
+	It("should block new Pods", Label("skip-on-openshift"), func() {
 		cs := ownerClient(tnt.Spec.Owners[0].UserSpec)
 		for _, namespace := range nsl {
 			Eventually(func() (err error) {