diff --git a/infrastructure/istio/manifests/mesh/authorization-policies.yaml b/infrastructure/istio/manifests/mesh/authorization-policies.yaml
index eabe042..6a5352b 100644
--- a/infrastructure/istio/manifests/mesh/authorization-policies.yaml
+++ b/infrastructure/istio/manifests/mesh/authorization-policies.yaml
@@ -275,7 +275,7 @@ spec:
     - from:
         - source:
             namespaces:
-              - netbird-operator
+              - netbird
     - from:
         - source:
             namespaces:
@@ -288,11 +288,15 @@ spec:
 
 ---
 # --- Netbird Operator: Allow intra-namespace + Prometheus ---
+# Operator runs in the "netbird" namespace, not "netbird-operator" (which
+# doesn't exist) - fixed 2026-08-17, was blocking istio-mesh-config from
+# ever going Synced (kubectl apply failed: "namespaces netbird-operator
+# not found").
 apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: allow-netbird-operator-access
-  namespace: netbird-operator
+  namespace: netbird
 spec:
   action: ALLOW
   rules:
@@ -300,7 +304,7 @@ spec:
     - from:
         - source:
             namespaces:
-              - netbird-operator
+              - netbird
     # Prometheus scraping (L4-only)
     - from:
         - source:
diff --git a/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml b/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
index b67e764..fd4f9c9 100644
--- a/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
+++ b/infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
@@ -23,11 +23,13 @@ spec:
     mode: PERMISSIVE
 ---
 # Netbird operator webhook receives calls from the API server
+# (namespace is "netbird", not "netbird-operator" - that namespace
+# doesn't exist; fixed 2026-08-17)
 apiVersion: security.istio.io/v1
 kind: PeerAuthentication
 metadata:
   name: allow-apiserver-webhooks
-  namespace: netbird-operator
+  namespace: netbird
 spec:
   mtls:
     mode: PERMISSIVE