diff --git a/cmd/provider/main.go b/cmd/provider/main.go
index f1d18793..08a34633 100644
--- a/cmd/provider/main.go
+++ b/cmd/provider/main.go
@@ -337,6 +337,7 @@ func main() {
 		webhookHost          = app.Flag("webhook-host", "The host of the webhook server.").Default("0.0.0.0").Envar("WEBHOOK_HOST").String()
 		webhookTLSCertDir    = app.Flag("webhook-tls-cert-dir", "The directory of TLS certificate that will be used by the webhook server. There should be tls.crt and tls.key files.").Default("/").Envar("WEBHOOK_TLS_CERT_DIR").String()
 		_                    = app.Flag("enable-validation-webhooks", "Enable support for Webhooks. [Deprecated, has no effect]").Default("false").Bool()
+		disableBucketWebhook = app.Flag("disable-bucket-validation-webhook", "Disable validation webhook for Bucket managed resources").Default("false").Envar("DISABLE_BUCKET_VALIDATION_WEBHOOK").Bool()
 		enableChangeLogs     = app.Flag("enable-changelogs", "Enable support for capturing change logs during reconciliation.").Default("false").Envar("ENABLE_CHANGE_LOGS").Bool()
 		changelogsSocketPath = app.Flag("changelogs-socket-path", "Path for changelogs socket (if enabled)").Default("/var/run/changelogs/changelogs.sock").Envar("CHANGELOGS_SOCKET_PATH").String()
 		// Subresource Client Flags.
@@ -478,7 +479,9 @@ func main() {
 	})
 	kingpin.FatalIfError(err, "Cannot create Kube client")
 
-	setupBucketWebhook(mgr, backendStore)
+	if !*disableBucketWebhook {
+		setupBucketWebhook(mgr, backendStore)
+	}
 	setupProviderConfigControllers(
 		mgr,
 		o,
diff --git a/docs/WEBHOOKS.md b/docs/WEBHOOKS.md
index 3fb70bfe..d1a5be33 100644
--- a/docs/WEBHOOKS.md
+++ b/docs/WEBHOOKS.md
@@ -9,7 +9,7 @@ Provider Ceph provides Dynamic Admission Control for Buckets.
 ### Bucket Validation Webhook
 Validates Bucket CRs for Create and Update operations.
 This webhook is also configured with an `objectSelector` label `provider-ceph.crossplane.io/validation-required: true`.
-It is the responsibility of the user (or the external system) to ensure that incoming Bucket CRs are given this label to enable webhook validation, should validation for the CR be desired.
+It is the responsibility of the user (or the external system) to ensure that incoming Bucket CRs are given this label to enable webhook validation, should validation for the CR be desired. This webhook can be disabled completely by the command line argument `--disable-bucket-validation-webhook` when starting the provider.
 
 Create and Update operations on Buckets are blocked by the bucket admission webhook when:
 - The Bucket contains one or more providers (`bucket.spec.Providers`) that do not exist (i.e. a `ProviderConfig` of the same name does not exist in the k8s cluster).