diff --git a/pkg/webhook/managedresource/validatingadmissionpolicy.go b/pkg/webhook/managedresource/validatingadmissionpolicy.go
index 2c14fe56a..b5f150b99 100644
--- a/pkg/webhook/managedresource/validatingadmissionpolicy.go
+++ b/pkg/webhook/managedresource/validatingadmissionpolicy.go
@@ -63,13 +63,13 @@ func mutateValidatingAdmissionPolicy(vap *admv1.ValidatingAdmissionPolicy) {
 				    &&
 					(
 						"system:masters" in request.userInfo.groups ||
-						"system:serviceaccounts:kube-system" in request.userInfo.groups ||
 						"system:serviceaccounts:fleet-system" in request.userInfo.groups
 					)
 				)
 				  ||
 				(
-					"system:serviceaccounts:openshift-infra" in request.userInfo.groups
+					"system:serviceaccounts:openshift-infra" in request.userInfo.groups ||
+					"system:serviceaccounts:kube-system" in request.userInfo.groups
 				)`,
 				Message: "Create, Update, or Delete operations on ARM managed resources is forbidden",
 				Reason:  &forbidden,