diff --git a/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml b/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml
index 5b1db7082..a38a0fc00 100644
--- a/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml
+++ b/bundle/manifests/discovery-operator-allow-webhook_networking.k8s.io_v1_networkpolicy.yaml
@@ -1,6 +1,14 @@
 # Allow ingress to the discovery-operator webhook server (port 9443).
-# Webhook calls originate from the API server which runs on the host network,
-# so we use the special host-network namespace selector.
+# Webhook calls originate from kube-apiserver, which validates the
+# DiscoveredCluster CRD and runs on the host network, so we use the
+# special host-network namespace selector.
+#
+# IMPORTANT: do not combine this namespaceSelector with a podSelector in
+# the same "from" entry (even an empty podSelector: {}). OVN-Kubernetes
+# does not correctly match host-network-sourced traffic against the
+# special "openshift-host-network" virtual namespace when a podSelector
+# is present alongside the namespaceSelector, causing all webhook calls
+# from kube-apiserver to silently time out.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -14,7 +22,6 @@ spec:
     - namespaceSelector:
         matchLabels:
           policy-group.network.openshift.io/host-network: ""
-      podSelector: {}
     ports:
     - protocol: TCP
       port: 9443
diff --git a/bundle/manifests/discovery.clusterserviceversion.yaml b/bundle/manifests/discovery.clusterserviceversion.yaml
index 16beda13d..a8034116b 100644
--- a/bundle/manifests/discovery.clusterserviceversion.yaml
+++ b/bundle/manifests/discovery.clusterserviceversion.yaml
@@ -21,7 +21,7 @@ metadata:
       ]
     capabilities: Seamless Upgrades
     categories: Integration & Delivery
-    createdAt: "2026-04-30T13:23:41Z"
+    createdAt: "2026-08-27T16:15:45Z"
     description: This operator discovers OpenShift Conatiner Platform clusters which
       are not yet under management by Open Cluster Management.
     operatorframework.io/suggested-namespace: open-cluster-management
@@ -241,6 +241,8 @@ spec:
                 ports:
                 - containerPort: 8080
                   name: metrics
+                - containerPort: 9443
+                  name: webhook-server
                 readinessProbe:
                   httpGet:
                     path: /readyz
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index 9683a28db..116b9c29b 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -56,6 +56,8 @@ spec:
         ports:
         - containerPort: 8080
           name: metrics
+        - containerPort: 9443
+          name: webhook-server
         resources:
           requests:
             cpu: 100m