diff --git a/webhook/configmaps/controller.go b/webhook/configmaps/controller.go
index 80ab3cab1d..277a47d08d 100644
--- a/webhook/configmaps/controller.go
+++ b/webhook/configmaps/controller.go
@@ -46,6 +46,12 @@ func NewAdmissionController(
 	secretInformer := secretinformer.Get(ctx)
 	options := webhook.GetOptions(ctx)
 
+	// if this environment variable is set, it overrides the value in the Options
+	disableNamespaceOwnership := webhook.DisableNamespaceOwnershipFromEnv()
+	if disableNamespaceOwnership != nil {
+		options.DisableNamespaceOwnership = *disableNamespaceOwnership
+	}
+
 	key := types.NamespacedName{Name: name}
 
 	wh := &reconciler{
diff --git a/webhook/resourcesemantics/defaulting/controller.go b/webhook/resourcesemantics/defaulting/controller.go
index 4e509d7a20..6a83b47845 100644
--- a/webhook/resourcesemantics/defaulting/controller.go
+++ b/webhook/resourcesemantics/defaulting/controller.go
@@ -84,6 +84,12 @@ func newController(ctx context.Context, name string, optsFunc ...OptionFunc) *co
 		f(opts)
 	}
 
+	// if this environment variable is set, it overrides the value in the Options
+	disableNamespaceOwnership := webhook.DisableNamespaceOwnershipFromEnv()
+	if disableNamespaceOwnership != nil {
+		wopts.DisableNamespaceOwnership = *disableNamespaceOwnership
+	}
+
 	key := types.NamespacedName{Name: name}
 
 	wh := &reconciler{
diff --git a/webhook/resourcesemantics/validation/controller.go b/webhook/resourcesemantics/validation/controller.go
index c8afa5c138..dc72b69d26 100644
--- a/webhook/resourcesemantics/validation/controller.go
+++ b/webhook/resourcesemantics/validation/controller.go
@@ -70,6 +70,12 @@ func newController(ctx context.Context, name string, optsFunc ...OptionFunc) *co
 		f(opts)
 	}
 
+	// if this environment variable is set, it overrides the value in the Options
+	disableNamespaceOwnership := webhook.DisableNamespaceOwnershipFromEnv()
+	if disableNamespaceOwnership != nil {
+		woptions.DisableNamespaceOwnership = *disableNamespaceOwnership
+	}
+
 	wh := &reconciler{
 		LeaderAwareFuncs: pkgreconciler.LeaderAwareFuncs{
 			// Have this reconciler enqueue our singleton whenever it becomes leader.
diff --git a/webhook/webhook.go b/webhook/webhook.go
index dc19817969..9dc736b40c 100644
--- a/webhook/webhook.go
+++ b/webhook/webhook.go
@@ -166,12 +166,6 @@ func New(
 		return nil, fmt.Errorf("unsupported TLS version: %d", opts.TLSMinVersion)
 	}
 
-	// if the environment variable is set, it overrides the value in the Options
-	disableNamespaceOwnership := DisableNamespaceOwnershipFromEnv()
-	if disableNamespaceOwnership != nil {
-		opts.DisableNamespaceOwnership = *disableNamespaceOwnership
-	}
-
 	syncCtx, cancel := context.WithCancel(context.Background())
 
 	webhook = &Webhook{