diff --git a/packages/core/installer/templates/cozy-system-labels.yaml b/packages/core/installer/templates/cozy-system-labels.yaml
new file mode 100644
index 00000000..995e5e3a
--- /dev/null
+++ b/packages/core/installer/templates/cozy-system-labels.yaml
@@ -0,0 +1,111 @@
+{{/*
+  Pre-install/upgrade hook that labels the cozy-system namespace with the
+  PodSecurity and cozystack identity labels. The chart no longer ships a
+  Namespace resource (helm v3 cannot adopt a namespace pre-created by
+  --create-namespace because it lacks helm meta annotations; without
+  --create-namespace, helm fails to write its release-secret because the
+  namespace does not exist yet — chicken-and-egg).
+  Install commands now use --create-namespace to bootstrap the namespace,
+  and this hook patches the labels the operator depends on (notably
+  pod-security.kubernetes.io/enforce=privileged for the host-network
+  operator pod).
+*/}}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cozy-system-labeler
+  namespace: cozy-system
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-200"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cozy-system-labeler
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-180"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+rules:
+- apiGroups: [""]
+  resources: ["namespaces"]
+  resourceNames: ["cozy-system"]
+  verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cozy-system-labeler
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-160"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+subjects:
+- kind: ServiceAccount
+  name: cozy-system-labeler
+  namespace: cozy-system
+roleRef:
+  kind: ClusterRole
+  name: cozy-system-labeler
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: cozy-system-labeler
+  namespace: cozy-system
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-100"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 60
+  template:
+    spec:
+      serviceAccountName: cozy-system-labeler
+      restartPolicy: OnFailure
+      # The hook runs BEFORE Cilium / kube-ovn / any CNI is installed, so the
+      # cluster's nodes are NotReady-NoSchedule and have no pod network. Mirror
+      # the cozystack-operator deployment's scheduling: hostNetwork=true so the
+      # pod doesn't need CNI, plus the same tolerations the operator uses.
+      hostNetwork: true
+      tolerations:
+      - key: "node.kubernetes.io/not-ready"
+        operator: "Exists"
+      - key: "node.kubernetes.io/unreachable"
+        operator: "Exists"
+      - key: "node.cilium.io/agent-not-ready"
+        operator: "Exists"
+      - key: "node.cloudprovider.kubernetes.io/uninitialized"
+        operator: "Exists"
+      containers:
+      - name: kubectl
+        image: alpine/k8s:1.32.0
+        imagePullPolicy: IfNotPresent
+        {{- if eq .Values.cozystackOperator.variant "talos" }}
+        env:
+        # Talos KubePrism endpoint — same as cozystack-operator uses to reach
+        # the apiserver before CNI is up.
+        - name: KUBERNETES_SERVICE_HOST
+          value: "localhost"
+        - name: KUBERNETES_SERVICE_PORT
+          value: "7445"
+        {{- else if eq .Values.cozystackOperator.variant "generic" }}
+        env:
+        - name: KUBERNETES_SERVICE_HOST
+          value: {{ required "cozystack.apiServerHost is required in generic mode" .Values.cozystack.apiServerHost | quote }}
+        - name: KUBERNETES_SERVICE_PORT
+          value: {{ .Values.cozystack.apiServerPort | quote }}
+        {{- end }}
+        command:
+        - kubectl
+        - label
+        - --overwrite
+        - namespace
+        - cozy-system
+        - cozystack.io/system=true
+        - pod-security.kubernetes.io/enforce=privileged
diff --git a/packages/core/installer/templates/cozystack-operator.yaml b/packages/core/installer/templates/cozystack-operator.yaml
index aded0995..461a71ed 100644
--- a/packages/core/installer/templates/cozystack-operator.yaml
+++ b/packages/core/installer/templates/cozystack-operator.yaml
@@ -4,16 +4,6 @@
 {{- end -}}
 ---
 apiVersion: v1
-kind: Namespace
-metadata:
-  name: cozy-system
-  labels:
-    cozystack.io/system: "true"
-    pod-security.kubernetes.io/enforce: privileged
-  annotations:
-    helm.sh/resource-policy: keep
----
-apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: cozystack