diff --git a/Makefile b/Makefile
index 5b0ecb1be..748f2c351 100644
--- a/Makefile
+++ b/Makefile
@@ -228,20 +228,20 @@ docker-push: ## Push docker image with the manager.
 .PHONY: install
 install: manifests kustomize ## Install API server & API services into the K8s cluster specified in ~/.kube/config. This requires APISERVER_IMG to be available for the cluster.
 	cd config/apiserver/server && $(KUSTOMIZE) edit set image apiserver=${APISERVER_IMG}
-	kubectl apply -k config/apiserver/default
+	kubectl apply -k config/apiserver/standalone
 
 .PHONY: uninstall
 uninstall: manifests kustomize ## Uninstall API server & API services from the K8s cluster specified in ~/.kube/config.
-	kubectl delete -k config/apiserver/default
+	kubectl delete -k config/apiserver/standalone
 
 .PHONY: deploy
 deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
 	cd config/controller/manager && $(KUSTOMIZE) edit set image controller=${CONTROLLER_IMG}
-	kubectl apply -k config/controller/default
+	kubectl apply -k config/controller/standalone
 
 .PHONY: undeploy
 undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
-	kubectl delete -k config/controller/default
+	kubectl delete -k config/controller/standalone
 
 ##@ Kind Deployment plumbing
 
diff --git a/config/apiserver/kind/kustomization.yaml b/config/apiserver/kind/kustomization.yaml
index f7246d535..dabc79580 100644
--- a/config/apiserver/kind/kustomization.yaml
+++ b/config/apiserver/kind/kustomization.yaml
@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../default
+  - ../standalone
 
 patchesStrategicMerge:
   - patch-apiserver.yaml
diff --git a/config/apiserver/server/server.yaml b/config/apiserver/server/server.yaml
index 294ad4bcd..541d0d5bc 100644
--- a/config/apiserver/server/server.yaml
+++ b/config/apiserver/server/server.yaml
@@ -1,10 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    control-plane: apiserver
-  name: system
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/config/apiserver/standalone-etcdless/kustomization.yaml b/config/apiserver/standalone-etcdless/kustomization.yaml
new file mode 100644
index 000000000..4a0c75d61
--- /dev/null
+++ b/config/apiserver/standalone-etcdless/kustomization.yaml
@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and IronCore contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Standalone install of the ironcore apiserver against an external etcd
+# (no in-cluster etcd StatefulSet): same content as config/apiserver/etcdless
+# plus the ironcore-system Namespace.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../etcdless
+  - ../../namespaces/ironcore-system
diff --git a/config/apiserver/standalone/kustomization.yaml b/config/apiserver/standalone/kustomization.yaml
new file mode 100644
index 000000000..b9f9a5ee9
--- /dev/null
+++ b/config/apiserver/standalone/kustomization.yaml
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and IronCore contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Standalone install of the ironcore apiserver (with the bundled etcd
+# StatefulSet): same content as config/apiserver/default plus the
+# ironcore-system Namespace. Use this when deploying the apiserver without
+# the controller manager.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../default
+  - ../../namespaces/ironcore-system
diff --git a/config/controller/kind/kustomization.yaml b/config/controller/kind/kustomization.yaml
index ef54eac44..a478b6ebd 100644
--- a/config/controller/kind/kustomization.yaml
+++ b/config/controller/kind/kustomization.yaml
@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../default
+  - ../standalone
 
 patchesStrategicMerge:
   - patch-manager.yaml
diff --git a/config/controller/manager/manager.yaml b/config/controller/manager/manager.yaml
index d8ed3b9e7..8a12c6b0b 100644
--- a/config/controller/manager/manager.yaml
+++ b/config/controller/manager/manager.yaml
@@ -1,10 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    control-plane: controller-manager
-  name: system
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/config/controller/standalone/kustomization.yaml b/config/controller/standalone/kustomization.yaml
new file mode 100644
index 000000000..c0bc3a893
--- /dev/null
+++ b/config/controller/standalone/kustomization.yaml
@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and IronCore contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Standalone install of the ironcore controller manager: same content as
+# config/controller/default plus the ironcore-system Namespace. Use this when
+# deploying the controller without the apiserver. The combined config/default
+# install references the Namespace kustomization directly, not via this
+# wrapper.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../default
+  - ../../namespaces/ironcore-system
diff --git a/config/default/apiserver/kustomization.yaml b/config/default/apiserver/kustomization.yaml
deleted file mode 100644
index 963d4dfae..000000000
--- a/config/default/apiserver/kustomization.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../apiserver/default
-
-patchesStrategicMerge:
-  - remove-namespace.yaml
diff --git a/config/default/apiserver/remove-namespace.yaml b/config/default/apiserver/remove-namespace.yaml
deleted file mode 100644
index 41334185b..000000000
--- a/config/default/apiserver/remove-namespace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ironcore-system
diff --git a/config/default/controller/kustomization.yaml b/config/default/controller/kustomization.yaml
deleted file mode 100644
index 18d6ac5ee..000000000
--- a/config/default/controller/kustomization.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../controller/default
-
-patchesStrategicMerge:
-  - remove-namespace.yaml
diff --git a/config/default/controller/remove-namespace.yaml b/config/default/controller/remove-namespace.yaml
deleted file mode 100644
index 41334185b..000000000
--- a/config/default/controller/remove-namespace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ironcore-system
diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml
index 51da5927e..1abc87e85 100644
--- a/config/default/kustomization.yaml
+++ b/config/default/kustomization.yaml
@@ -1,7 +1,13 @@
+# SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and IronCore contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Combined install: apiserver (with bundled etcd) + controller manager.
+# Both bases are namespace-free; the namespace kustomization is referenced
+# directly here. This replaces the previous remove-namespace.yaml patch dance.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - namespace.yaml
-  - apiserver
-  - controller
+  - ../apiserver/default
+  - ../controller/default
+  - ../namespaces/ironcore-system
diff --git a/config/default/namespace.yaml b/config/default/namespace.yaml
deleted file mode 100644
index db9e7cff3..000000000
--- a/config/default/namespace.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ironcore-system
-  labels:
-    control-plane: apiserver-controller
diff --git a/config/etcdless/apiserver/kustomization.yaml b/config/etcdless/apiserver/kustomization.yaml
deleted file mode 100644
index cbbc70dc4..000000000
--- a/config/etcdless/apiserver/kustomization.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../apiserver/etcdless
-
-patchesStrategicMerge:
-  - remove-namespace.yaml
diff --git a/config/etcdless/apiserver/remove-namespace.yaml b/config/etcdless/apiserver/remove-namespace.yaml
deleted file mode 100644
index 41334185b..000000000
--- a/config/etcdless/apiserver/remove-namespace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ironcore-system
diff --git a/config/etcdless/controller/kustomization.yaml b/config/etcdless/controller/kustomization.yaml
deleted file mode 100644
index 18d6ac5ee..000000000
--- a/config/etcdless/controller/kustomization.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../controller/default
-
-patchesStrategicMerge:
-  - remove-namespace.yaml
diff --git a/config/etcdless/controller/remove-namespace.yaml b/config/etcdless/controller/remove-namespace.yaml
deleted file mode 100644
index 41334185b..000000000
--- a/config/etcdless/controller/remove-namespace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ironcore-system
diff --git a/config/etcdless/kustomization.yaml b/config/etcdless/kustomization.yaml
index 51da5927e..3fe4f2870 100644
--- a/config/etcdless/kustomization.yaml
+++ b/config/etcdless/kustomization.yaml
@@ -1,7 +1,13 @@
+# SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and IronCore contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# Combined install with an external etcd (no in-cluster etcd StatefulSet):
+# apiserver/etcdless + controller manager. Same shape as config/default but
+# pulls the etcdless apiserver base.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - namespace.yaml
-  - apiserver
-  - controller
+  - ../apiserver/etcdless
+  - ../controller/default
+  - ../namespaces/ironcore-system
diff --git a/config/etcdless/namespace.yaml b/config/etcdless/namespace.yaml
deleted file mode 100644
index db9e7cff3..000000000
--- a/config/etcdless/namespace.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ironcore-system
-  labels:
-    control-plane: apiserver-controller
diff --git a/config/namespaces/ironcore-system/kustomization.yaml b/config/namespaces/ironcore-system/kustomization.yaml
new file mode 100644
index 000000000..dca4a5188
--- /dev/null
+++ b/config/namespaces/ironcore-system/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
diff --git a/config/namespaces/ironcore-system/namespace.yaml b/config/namespaces/ironcore-system/namespace.yaml
new file mode 100644
index 000000000..19abc089a
--- /dev/null
+++ b/config/namespaces/ironcore-system/namespace.yaml
@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and IronCore contributors
+# SPDX-License-Identifier: Apache-2.0
+
+# The namespace where the ironcore apiserver and controller manager run.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ironcore-system
+  labels:
+    control-plane: apiserver-controller
diff --git a/hack/validate-kustomize.sh b/hack/validate-kustomize.sh
index a270c55fd..440bf4cf2 100755
--- a/hack/validate-kustomize.sh
+++ b/hack/validate-kustomize.sh
@@ -12,7 +12,7 @@ normal="$(tput sgr0)"
 
 for kustomization in "$BASEDIR"/../config/*/**/kustomization.yaml; do
   path="$(dirname "$kustomization")"
-  dir="$(realpath --relative-to "$BASEDIR"/.. "$path")"
+  dir="${path#$BASEDIR/../}"
   echo "${bold}Validating $dir${normal}"
   if ! kustomize_output="$(kustomize build "$path" 2>&1)"; then
     echo "${red}Kustomize build $dir failed:"