diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml
index 46586944..c435fe43 100644
--- a/config/webhook/manifests.yaml
+++ b/config/webhook/manifests.yaml
@@ -210,6 +210,27 @@ webhooks:
     resources:
     - services
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /tenant-cordoning
+  failurePolicy: Fail
+  name: cordoning.tenant.capsule.clastix.io
+  rules:
+  - apiGroups:
+    - '*'
+    apiVersions:
+    - '*'
+    operations:
+    - CREATE
+    - UPDATE
+    - DELETE
+    resources:
+    - '*'
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   clientConfig:
diff --git a/config/webhook/patch_ns_selector.yaml b/config/webhook/patch_ns_selector.yaml
index d5312b2e..36da24e5 100644
--- a/config/webhook/patch_ns_selector.yaml
+++ b/config/webhook/patch_ns_selector.yaml
@@ -46,3 +46,6 @@
     matchExpressions:
       - key: capsule.clastix.io/tenant
         operator: Exists
+- op: add
+  path: /webhooks/8/rules/0/scope
+  value: Namespaced