diff --git a/CHANGELOG.md b/CHANGELOG.md
index 760c3671474..1356b07bbc5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ### 7.8-SNAPSHOT
 
 #### Bugs
+* Fix #7952: (crd-generator) Multiple package exclusions now compose with AND semantics, so a scanned class is loaded only when it avoids every excluded prefix instead of being retained by the OR of negated package predicates
 * Fix #7953: (httpclient-jdk) bodyless requests now preserve the requested HTTP method instead of silently defaulting to `GET`. `JdkHttpClientImpl.requestBuilder` only called `HttpRequest.Builder.method(...)` inside the `body != null` branch, so a bodyless `DELETE`/`POST`/`PUT`/`PATCH` (such as `client.raw(uri, "DELETE", null)`) was sent as `GET` on the JDK backend; the method is now set with `BodyPublishers.noBody()` when there is no body, matching the OkHttp, Jetty and Vert.x backends
 * Fix #7435: (kubernetes-client) A `SharedIndexInformer`'s periodic resync no longer stops permanently and silently when a single resync cycle throws. `DefaultSharedIndexInformer.scheduleResync` runs the resync through `Utils.scheduleAtFixedRate`, whose self-rescheduling chain re-arms the next cycle only when the previous one completes normally; an uncaught exception completed the (unobserved) `resyncFuture` exceptionally and the resync was never scheduled again, with no log, while the independent watch kept `isWatching()` reporting `true` (a restart was required to recover). The resync command now catches and `WARN`-logs the failure so the schedule fires again at the next interval
 * Fix #7933: (kubernetes-client-api) Deterministic TLS trust failures (untrusted cert, expired cert, hostname mismatch) are now classified as terminal and fail fast instead of being retried by the shared `StandardHttpClient.shouldRetry` backoff loop (~19 s drain). The classifier walks both `getCause()` and `getSuppressed()` trees for `CertificateException`, `CertPathValidatorException`, `CertPathBuilderException`, and `SSLPeerUnverifiedException`. Affects all five HTTP client modules (jdk, jetty, okhttp, vertx-4, vertx-5) on both the HTTP request and WebSocket connect paths
diff --git a/crd-generator/collector/src/main/java/io/fabric8/crd/generator/collector/CustomResourceCollector.java b/crd-generator/collector/src/main/java/io/fabric8/crd/generator/collector/CustomResourceCollector.java
index 24412590013..9831d1bbfb0 100644
--- a/crd-generator/collector/src/main/java/io/fabric8/crd/generator/collector/CustomResourceCollector.java
+++ b/crd-generator/collector/src/main/java/io/fabric8/crd/generator/collector/CustomResourceCollector.java
@@ -146,7 +146,7 @@ public CustomResourceCollector withExcludePackages(Collection<String> packages)
       packages.stream()
           .filter(Objects::nonNull)
           .map(pkg -> (Predicate<String>) s -> !s.startsWith(pkg))
-          .reduce(Predicate::or)
+          .reduce(Predicate::and)
           .ifPresent(this.classNamePredicates::add);
     }
     return this;
diff --git a/crd-generator/collector/src/test/java/io/fabric8/crd/generator/collector/CustomResourceCollectorTest.java b/crd-generator/collector/src/test/java/io/fabric8/crd/generator/collector/CustomResourceCollectorTest.java
index a7effc86e6e..9432b9354de 100644
--- a/crd-generator/collector/src/test/java/io/fabric8/crd/generator/collector/CustomResourceCollectorTest.java
+++ b/crd-generator/collector/src/test/java/io/fabric8/crd/generator/collector/CustomResourceCollectorTest.java
@@ -107,6 +107,16 @@ void givenClassNameAndExcludePackage_thenNoLoading() {
     assertEquals(0, classes.size());
   }
 
+  @Test
+  void givenClassNameAndMultipleExcludePackages_thenNoLoading() {
+    customResourceCollector.withCustomResourceClass("com.example.Test");
+    customResourceCollector.withExcludePackages(Arrays.asList("com.example", "com.other"));
+
+    List<Class<? extends HasMetadata>> classes = customResourceCollector.findCustomResourceClasses();
+    verify(customResourceClassLoader, times(0)).loadCustomResourceClass(anyString());
+    assertEquals(0, classes.size());
+  }
+
   @Test
   void givenClassNamesAndIncludePackage_thenLoad() {
     customResourceCollector.withCustomResourceClass("com.example.Test", "com.other.Test");