diff --git a/infrastructure/kyverno/policies/argocd-exception.yaml b/infrastructure/kyverno/policies/argocd-exception.yaml
new file mode 100644
index 0000000..ad16dc8
--- /dev/null
+++ b/infrastructure/kyverno/policies/argocd-exception.yaml
@@ -0,0 +1,27 @@
+# ArgoCD upstream Helm chart does not set resource limits or probes on
+# several components. These are audit-mode policies and ArgoCD is a
+# third-party chart we don't control.
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: argocd-exemption
+  namespace: kyverno
+spec:
+  exceptions:
+    - policyName: require-resource-limits
+      ruleNames:
+        - require-limits
+        - autogen-require-limits
+    - policyName: require-probes
+      ruleNames:
+        - require-probes
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - StatefulSet
+            - ReplicaSet
+            - Pod
+          namespaces:
+            - argocd
diff --git a/infrastructure/kyverno/policies/netbird-operator-exception.yaml b/infrastructure/kyverno/policies/netbird-operator-exception.yaml
new file mode 100644
index 0000000..1d89859
--- /dev/null
+++ b/infrastructure/kyverno/policies/netbird-operator-exception.yaml
@@ -0,0 +1,33 @@
+# NetBird operator upstream chart does not set resource limits and
+# automounts the SA token for Kubernetes API access.
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: netbird-operator-exemption
+  namespace: kyverno
+spec:
+  exceptions:
+    - policyName: require-resource-limits
+      ruleNames:
+        - require-limits
+        - autogen-require-limits
+    - policyName: disallow-automount-sa-token
+      ruleNames:
+        - validate-automount
+        - autogen-validate-automount
+    - policyName: require-probes
+      ruleNames:
+        - require-probes
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - ReplicaSet
+            - Pod
+          namespaces:
+            - netbird-operator
+            - netbird
+          names:
+            - netbird-operator*
+            - netbird-cluster-router*
diff --git a/infrastructure/kyverno/policies/scylla-exception.yaml b/infrastructure/kyverno/policies/scylla-exception.yaml
new file mode 100644
index 0000000..7581d90
--- /dev/null
+++ b/infrastructure/kyverno/policies/scylla-exception.yaml
@@ -0,0 +1,27 @@
+# Scylla Manager and ScyllaDB upstream charts do not drop all
+# capabilities and automount the SA token for cluster management.
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: scylla-exemption
+  namespace: kyverno
+spec:
+  exceptions:
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-drop-all
+        - autogen-require-drop-all
+    - policyName: disallow-automount-sa-token
+      ruleNames:
+        - validate-automount
+        - autogen-validate-automount
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - StatefulSet
+            - ReplicaSet
+            - Pod
+          namespaces:
+            - scylla-manager