diff --git a/charts/function-mesh-operator/README.md b/charts/function-mesh-operator/README.md
index 118ec096a..52219f668 100644
--- a/charts/function-mesh-operator/README.md
+++ b/charts/function-mesh-operator/README.md
@@ -36,6 +36,8 @@ function mesh operator Helm chart for Kubernetes
 | controllerManager.create | bool | `true` |  |
 | controllerManager.enableInitContainers | bool | `false` |  |
 | controllerManager.enableLeaderElection | bool | `true` |  |
+| controllerManager.extraEnv | list | `[]` | Additional operator environment variables; do not repeat NAMESPACE or ENABLE_WEBHOOKS. |
+| controllerManager.extraEnvFrom | list | `[]` | ConfigMap and Secret references for operator environment variables. |
 | controllerManager.globalBackendConfig | string | `"global-backend-config"` |  |
 | controllerManager.globalBackendConfigNamespace | string | `"default"` |  |
 | controllerManager.healthProbe.port | int | `8000` |  |
diff --git a/charts/function-mesh-operator/charts/admission-webhook/README.md b/charts/function-mesh-operator/charts/admission-webhook/README.md
index e2c1b7c7a..3e981400c 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/README.md
+++ b/charts/function-mesh-operator/charts/admission-webhook/README.md
@@ -20,7 +20,9 @@ function mesh admission webhook Helm chart for Kubernetes
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
+| admissionWebhook.certificate.commonName | string | `""` | Optional subject Common Name for the cert-manager serving certificate. |
 | admissionWebhook.certificate.provider | string | `"cert-manager"` |  |
+| admissionWebhook.crdAnnotations | object | `{}` | Additional annotations applied to every Function Mesh CRD. |
 | admissionWebhook.enabled | bool | `true` |  |
 | admissionWebhook.failurePolicy | string | `"Fail"` |  |
 | admissionWebhook.secretsWebhookNamespace | string | `"default"` |  |
diff --git a/charts/function-mesh-operator/charts/admission-webhook/templates/certificates.yaml b/charts/function-mesh-operator/charts/admission-webhook/templates/certificates.yaml
index fef7245d8..0e03d85c1 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/templates/certificates.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/templates/certificates.yaml
@@ -7,6 +7,9 @@ metadata:
   labels:
     {{- include "function-mesh-operator.labels" . | nindent 4 }}
 spec:
+  {{- with .Values.admissionWebhook.certificate.commonName }}
+  commonName: {{ . | quote }}
+  {{- end }}
   dnsNames:
     - {{ include "function-mesh-operator.certificate.commonName" . }}
   issuerRef:
diff --git a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-backendconfigs.yaml b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-backendconfigs.yaml
index f48a76c1f..071111a2f 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-backendconfigs.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-backendconfigs.yaml
@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}
diff --git a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functionmeshes.yaml b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functionmeshes.yaml
index 0470ae5db..ba097bcaa 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functionmeshes.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functionmeshes.yaml
@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     controller-gen.kubebuilder.io/version: v0.16.5
   name: functionmeshes.compute.functionmesh.io
 spec:
diff --git a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functions.yaml b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functions.yaml
index e34390253..52f709536 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functions.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functions.yaml
@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}
diff --git a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sinks.yaml b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sinks.yaml
index e35f4461f..a14d2d75f 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sinks.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sinks.yaml
@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}
diff --git a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sources.yaml b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sources.yaml
index 024262496..6dbd1b34a 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sources.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sources.yaml
@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}
diff --git a/charts/function-mesh-operator/charts/admission-webhook/values.yaml b/charts/function-mesh-operator/charts/admission-webhook/values.yaml
index 9aea01be6..b754f1476 100644
--- a/charts/function-mesh-operator/charts/admission-webhook/values.yaml
+++ b/charts/function-mesh-operator/charts/admission-webhook/values.yaml
@@ -4,9 +4,13 @@
 
 admissionWebhook:
   enabled: true
+  # -- Additional annotations applied to every Function Mesh CRD.
+  crdAnnotations: {}
   secretsWebhookNamespace: default
   failurePolicy: Fail
   certificate:
+    # -- Optional subject Common Name for the cert-manager serving certificate.
+    commonName: ""
     ## The available providers are:
     ##   "cert-manager": manage certificates with Cert-Manager, default
     ##   "custom": provide custom certificates, you need to install the `function-mesh-secrets-webhook` chart first
diff --git a/charts/function-mesh-operator/templates/controller-manager-deployment.yaml b/charts/function-mesh-operator/templates/controller-manager-deployment.yaml
index 063d8a194..fa266c509 100644
--- a/charts/function-mesh-operator/templates/controller-manager-deployment.yaml
+++ b/charts/function-mesh-operator/templates/controller-manager-deployment.yaml
@@ -83,6 +83,13 @@ spec:
                 fieldPath: metadata.namespace
           - name: ENABLE_WEBHOOKS
             value: {{ .Values.admissionWebhook.enabled | quote }}
+          {{- with .Values.controllerManager.extraEnv }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+        {{- with .Values.controllerManager.extraEnvFrom }}
+        envFrom:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         volumeMounts:
         {{- include "function-mesh-operator.volumeMounts" . | nindent 8 }}
         livenessProbe:
diff --git a/charts/function-mesh-operator/templates/controller-manager-rbac.yaml b/charts/function-mesh-operator/templates/controller-manager-rbac.yaml
index aea5c764a..3bc902292 100644
--- a/charts/function-mesh-operator/templates/controller-manager-rbac.yaml
+++ b/charts/function-mesh-operator/templates/controller-manager-rbac.yaml
@@ -168,6 +168,15 @@ rules:
       - patch
       - update
       - watch
+  - apiGroups:
+      - compute.functionmesh.io
+    resources:
+      - functions/finalizers
+      - sources/finalizers
+      - sinks/finalizers
+    verbs:
+      - get
+      - update
   - apiGroups:
       - compute.functionmesh.io
     resources:
diff --git a/charts/function-mesh-operator/values.yaml b/charts/function-mesh-operator/values.yaml
index c2105392b..12ea8e412 100644
--- a/charts/function-mesh-operator/values.yaml
+++ b/charts/function-mesh-operator/values.yaml
@@ -17,6 +17,10 @@ imagePullSecrets: []
 
 controllerManager:
   create: true
+  # -- Additional operator environment variables; do not repeat NAMESPACE or ENABLE_WEBHOOKS.
+  extraEnv: []
+  # -- ConfigMap and Secret references for operator environment variables.
+  extraEnvFrom: []
   # With rbac.create=false, the user is responsible for creating this account
   # With rbac.create=true, this service account will be created
   # Also see rbac.create and clusterScoped
diff --git a/hack/gen-helm-crd-templates.sh b/hack/gen-helm-crd-templates.sh
index ff5affd2e..323b4ac7f 100755
--- a/hack/gen-helm-crd-templates.sh
+++ b/hack/gen-helm-crd-templates.sh
@@ -32,6 +32,9 @@ function crd::convert_metadata() {
     echo "metadata:"
     # metadata.annotations
     echo "annotations:" | sed  "s/^/$(crd::nindent 1)/"
+    echo '{{- with .Values.admissionWebhook.crdAnnotations }}' | sed "s/^/$(crd::nindent 2)/"
+    echo '{{- toYaml . | nindent 4 }}' | sed "s/^/$(crd::nindent 2)/"
+    echo '{{- end }}' | sed "s/^/$(crd::nindent 2)/"
     if "$webhook_enabled"; then
         echo "{{- if eq .Values.admissionWebhook.certificate.provider \"cert-manager\" }}" | sed  "s/^/$(crd::nindent 2)/"
         echo "{{- include \"function-mesh-operator.certManager.annotation\" . | nindent 4 -}}" | sed  "s/^/$(crd::nindent 3)/"
@@ -158,4 +161,4 @@ function crd::main() {
     crd::generate_template "$source_file" "$target_file" true
 }
 
-crd::main
\ No newline at end of file
+crd::main