diff --git a/.github/workflows/subsystem.yaml b/.github/workflows/subsystem.yaml
index 41765a1..4992900 100644
--- a/.github/workflows/subsystem.yaml
+++ b/.github/workflows/subsystem.yaml
@@ -6,13 +6,6 @@ on:
   pull_request:
     branches: [main, 'release/v*']
 
-# All jobs build control-plane via Containerfile (UBI builder + runtime).
-# Pre-pull with retries avoids flaky CDN EOFs during podman-compose build.
-env:
-  CONTROL_PLANE_BUILD_IMAGES: >-
-    registry.access.redhat.com/ubi9/go-toolset:1.25.5
-    registry.access.redhat.com/ubi9/ubi-minimal:latest
-
 jobs:
   policy-subsystem:
     uses: dcm-project/shared-workflows/.github/workflows/black-box.yaml@main
@@ -20,7 +13,10 @@ jobs:
       up-target: policy-subsystem-test-up
       test-target: policy-subsystem-test
       down-target: policy-subsystem-test-down
-      images: "${{ env.CONTROL_PLANE_BUILD_IMAGES }} quay.io/sclorg/postgresql-16-c9s:latest"
+      images: >-
+        registry.access.redhat.com/ubi9/go-toolset:1.25.5
+        registry.access.redhat.com/ubi9/ubi-minimal:latest
+        quay.io/sclorg/postgresql-16-c9s:latest
 
   catalog-subsystem:
     uses: dcm-project/shared-workflows/.github/workflows/black-box.yaml@main
@@ -28,7 +24,11 @@ jobs:
       up-target: catalog-subsystem-test-up
       test-target: catalog-subsystem-test
       down-target: catalog-subsystem-test-down
-      images: "${{ env.CONTROL_PLANE_BUILD_IMAGES }} quay.io/sclorg/postgresql-16-c9s:latest wiremock/wiremock:3x"
+      images: >-
+        registry.access.redhat.com/ubi9/go-toolset:1.25.5
+        registry.access.redhat.com/ubi9/ubi-minimal:latest
+        quay.io/sclorg/postgresql-16-c9s:latest
+        wiremock/wiremock:3x
 
   sp-subsystem:
     uses: dcm-project/shared-workflows/.github/workflows/black-box.yaml@main
@@ -36,4 +36,9 @@ jobs:
       up-target: sp-subsystem-test-up
       test-target: sp-subsystem-test
       down-target: sp-subsystem-test-down
-      images: "${{ env.CONTROL_PLANE_BUILD_IMAGES }} quay.io/sclorg/postgresql-16-c9s:latest wiremock/wiremock:3x docker.io/library/nats:2-alpine"
+      images: >-
+        registry.access.redhat.com/ubi9/go-toolset:1.25.5
+        registry.access.redhat.com/ubi9/ubi-minimal:latest
+        quay.io/sclorg/postgresql-16-c9s:latest
+        wiremock/wiremock:3x
+        docker.io/library/nats:2-alpine
diff --git a/internal/app/openapi.go b/internal/app/openapi.go
index de31a69..2aa333d 100644
--- a/internal/app/openapi.go
+++ b/internal/app/openapi.go
@@ -56,6 +56,10 @@ func oapiRequestValidator(spec *openapi3.T) func(http.Handler) http.Handler {
 	return nethttpmiddleware.OapiRequestValidatorWithOptions(spec, &nethttpmiddleware.Options{
 		Options: openapi3filter.Options{
 			AuthenticationFunc: openapi3filter.NoopAuthenticationFunc,
+			// kin-openapi rewrites validated bodies when schema defaults are applied,
+			// but only registers encoders for application/json. PATCH merge bodies
+			// use application/merge-patch+json and must stay partial (RFC 7396).
+			SkipSettingDefaults: true,
 		},
 		SilenceServersWarning: true,
 	})
diff --git a/internal/app/openapi_validation_test.go b/internal/app/openapi_validation_test.go
index c2f4534..126c665 100644
--- a/internal/app/openapi_validation_test.go
+++ b/internal/app/openapi_validation_test.go
@@ -37,6 +37,22 @@ var _ = Describe("OpenAPI request validation", func() {
 		It("rejects malformed JSON on POST /policies", func() {
 			expectInvalidJSONRejected(validators, "/api/v1alpha1/policies")
 		})
+
+		It("allows valid partial PATCH on /policies/{policyId}", func() {
+			router := chi.NewRouter()
+			router.Use(validators.middleware())
+			router.Patch("/api/v1alpha1/policies/{policyId}", func(w http.ResponseWriter, _ *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			body := `{"display_name":"Updated Name","priority":600}`
+			req := httptest.NewRequest(http.MethodPatch, "/api/v1alpha1/policies/test-policy-id", strings.NewReader(body))
+			req.Header.Set("Content-Type", "application/merge-patch+json")
+			rec := httptest.NewRecorder()
+			router.ServeHTTP(rec, req)
+
+			Expect(rec.Code).To(Equal(http.StatusOK), rec.Body.String())
+		})
 	})
 
 	Describe("catalog routes", func() {