diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml
index f5c4e1988b1d2..fff9ed8207fdb 100644
--- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml
+++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml
@@ -3,6 +3,10 @@ base_images:
     name: cli-operator-sdk
     namespace: ocp
     tag: v1.31.0
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
   ubi-min9:
     name: ubi-minimal
     namespace: ocp
@@ -106,6 +110,187 @@ tests:
           cpu: 100m
           memory: 200Mi
     workflow: optional-operators-ci-operator-sdk-aws
+- always_run: false
+  as: install-bundle-tls-scan
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: operator-bundle
+    env:
+      COMPUTE_NODE_TYPE: m5.2xlarge
+      OO_INSTALL_NAMESPACE: oran-o2ims
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: oran-o2ims
+      SCANNER_NAMESPACE: oran-o2ims
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - ref: optional-operators-operator-sdk
+    - as: wait-for-server-pods
+      cli: latest
+      commands: |
+        NAMESPACE=oran-o2ims
+        echo "Waiting for Inventory CR to be auto-created..."
+        for i in $(seq 1 60); do
+          if oc get inventory default -n "$NAMESPACE" &>/dev/null; then
+            echo "Inventory CR 'default' found."
+            break
+          fi
+          echo "  attempt $i/60..."
+          sleep 5
+        done
+
+        echo ""
+        echo "Discovering services with TLS serving certs..."
+        TLS_SERVICES=$(oc get services -n "$NAMESPACE" \
+          -o jsonpath='{range .items[?(@.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name)]}{.metadata.name}{"\n"}{end}')
+
+        echo "TLS services found:"
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          echo "  $svc -> secret: $SECRET"
+        done
+
+        echo ""
+        echo "Waiting for TLS service pods to be ready..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SELECTOR=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o go-template='{{range $k,$v := .spec.selector}}{{$k}}={{$v}},{{end}}' | sed 's/,$//')
+          if [ -z "$SELECTOR" ]; then
+            echo "  SKIP: $svc has no selector"
+            continue
+          fi
+          echo "  $svc (selector: $SELECTOR)..."
+          if ! oc wait pods -l "$SELECTOR" -n "$NAMESPACE" \
+            --for=condition=Ready --timeout=5m; then
+            echo "  WARNING: pods for $svc did not become ready within 5m"
+            echo "  Pod status:"
+            oc get pods -l "$SELECTOR" -n "$NAMESPACE" --no-headers | sed 's/^/    /'
+            echo "  Recent events:"
+            oc get events -n "$NAMESPACE" --field-selector reason!=Pulling,reason!=Pulled \
+              --sort-by='.lastTimestamp' 2>/dev/null | grep "$svc" | tail -5 | sed 's/^/    /' \
+              || echo "    (no events found)"
+          fi
+        done
+
+        echo ""
+        echo "Verifying TLS secrets from service-ca..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          if oc get secret "$SECRET" -n "$NAMESPACE" &>/dev/null; then
+            echo "  $SECRET exists"
+          else
+            echo "  WARNING: $SECRET not found"
+          fi
+        done
+
+        echo ""
+        echo "Final pod status in $NAMESPACE:"
+        oc get pods -n "$NAMESPACE"
+      from: cli
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: ipi-aws
+- as: install-bundle-tls-scan-periodic
+  cron: 0 3 * * 5
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: operator-bundle
+    env:
+      COMPUTE_NODE_TYPE: m5.2xlarge
+      OO_INSTALL_NAMESPACE: oran-o2ims
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: oran-o2ims
+      SCANNER_NAMESPACE: oran-o2ims
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - ref: optional-operators-operator-sdk
+    - as: wait-for-server-pods
+      cli: latest
+      commands: |
+        NAMESPACE=oran-o2ims
+        echo "Waiting for Inventory CR to be auto-created..."
+        for i in $(seq 1 60); do
+          if oc get inventory default -n "$NAMESPACE" &>/dev/null; then
+            echo "Inventory CR 'default' found."
+            break
+          fi
+          echo "  attempt $i/60..."
+          sleep 5
+        done
+
+        echo ""
+        echo "Discovering services with TLS serving certs..."
+        TLS_SERVICES=$(oc get services -n "$NAMESPACE" \
+          -o jsonpath='{range .items[?(@.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name)]}{.metadata.name}{"\n"}{end}')
+
+        echo "TLS services found:"
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          echo "  $svc -> secret: $SECRET"
+        done
+
+        echo ""
+        echo "Waiting for TLS service pods to be ready..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SELECTOR=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o go-template='{{range $k,$v := .spec.selector}}{{$k}}={{$v}},{{end}}' | sed 's/,$//')
+          if [ -z "$SELECTOR" ]; then
+            echo "  SKIP: $svc has no selector"
+            continue
+          fi
+          echo "  $svc (selector: $SELECTOR)..."
+          if ! oc wait pods -l "$SELECTOR" -n "$NAMESPACE" \
+            --for=condition=Ready --timeout=5m; then
+            echo "  WARNING: pods for $svc did not become ready within 5m"
+            echo "  Pod status:"
+            oc get pods -l "$SELECTOR" -n "$NAMESPACE" --no-headers | sed 's/^/    /'
+            echo "  Recent events:"
+            oc get events -n "$NAMESPACE" --field-selector reason!=Pulling,reason!=Pulled \
+              --sort-by='.lastTimestamp' 2>/dev/null | grep "$svc" | tail -5 | sed 's/^/    /' \
+              || echo "    (no events found)"
+          fi
+        done
+
+        echo ""
+        echo "Verifying TLS secrets from service-ca..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          if oc get secret "$SECRET" -n "$NAMESPACE" &>/dev/null; then
+            echo "  $SECRET exists"
+          else
+            echo "  WARNING: $SECRET not found"
+          fi
+        done
+
+        echo ""
+        echo "Final pod status in $NAMESPACE:"
+        oc get pods -n "$NAMESPACE"
+      from: cli
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: ipi-aws
 - always_run: false
   as: markdownlint
   commands: |
diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml
index 755cd30caf648..9bdcc253d28fa 100644
--- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml
+++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml
@@ -3,6 +3,10 @@ base_images:
     name: cli-operator-sdk
     namespace: ocp
     tag: v1.31.0
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
   ubi-min9:
     name: ubi-minimal
     namespace: ocp
@@ -106,6 +110,187 @@ tests:
           cpu: 100m
           memory: 200Mi
     workflow: optional-operators-ci-operator-sdk-aws
+- always_run: false
+  as: install-bundle-tls-scan
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: operator-bundle
+    env:
+      COMPUTE_NODE_TYPE: m5.2xlarge
+      OO_INSTALL_NAMESPACE: oran-o2ims
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: oran-o2ims
+      SCANNER_NAMESPACE: oran-o2ims
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - ref: optional-operators-operator-sdk
+    - as: wait-for-server-pods
+      cli: latest
+      commands: |
+        NAMESPACE=oran-o2ims
+        echo "Waiting for Inventory CR to be auto-created..."
+        for i in $(seq 1 60); do
+          if oc get inventory default -n "$NAMESPACE" &>/dev/null; then
+            echo "Inventory CR 'default' found."
+            break
+          fi
+          echo "  attempt $i/60..."
+          sleep 5
+        done
+
+        echo ""
+        echo "Discovering services with TLS serving certs..."
+        TLS_SERVICES=$(oc get services -n "$NAMESPACE" \
+          -o jsonpath='{range .items[?(@.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name)]}{.metadata.name}{"\n"}{end}')
+
+        echo "TLS services found:"
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          echo "  $svc -> secret: $SECRET"
+        done
+
+        echo ""
+        echo "Waiting for TLS service pods to be ready..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SELECTOR=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o go-template='{{range $k,$v := .spec.selector}}{{$k}}={{$v}},{{end}}' | sed 's/,$//')
+          if [ -z "$SELECTOR" ]; then
+            echo "  SKIP: $svc has no selector"
+            continue
+          fi
+          echo "  $svc (selector: $SELECTOR)..."
+          if ! oc wait pods -l "$SELECTOR" -n "$NAMESPACE" \
+            --for=condition=Ready --timeout=5m; then
+            echo "  WARNING: pods for $svc did not become ready within 5m"
+            echo "  Pod status:"
+            oc get pods -l "$SELECTOR" -n "$NAMESPACE" --no-headers | sed 's/^/    /'
+            echo "  Recent events:"
+            oc get events -n "$NAMESPACE" --field-selector reason!=Pulling,reason!=Pulled \
+              --sort-by='.lastTimestamp' 2>/dev/null | grep "$svc" | tail -5 | sed 's/^/    /' \
+              || echo "    (no events found)"
+          fi
+        done
+
+        echo ""
+        echo "Verifying TLS secrets from service-ca..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          if oc get secret "$SECRET" -n "$NAMESPACE" &>/dev/null; then
+            echo "  $SECRET exists"
+          else
+            echo "  WARNING: $SECRET not found"
+          fi
+        done
+
+        echo ""
+        echo "Final pod status in $NAMESPACE:"
+        oc get pods -n "$NAMESPACE"
+      from: cli
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: ipi-aws
+- as: install-bundle-tls-scan-periodic
+  cron: 0 3 * * 1
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: operator-bundle
+    env:
+      COMPUTE_NODE_TYPE: m5.2xlarge
+      OO_INSTALL_NAMESPACE: oran-o2ims
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: oran-o2ims
+      SCANNER_NAMESPACE: oran-o2ims
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - ref: optional-operators-operator-sdk
+    - as: wait-for-server-pods
+      cli: latest
+      commands: |
+        NAMESPACE=oran-o2ims
+        echo "Waiting for Inventory CR to be auto-created..."
+        for i in $(seq 1 60); do
+          if oc get inventory default -n "$NAMESPACE" &>/dev/null; then
+            echo "Inventory CR 'default' found."
+            break
+          fi
+          echo "  attempt $i/60..."
+          sleep 5
+        done
+
+        echo ""
+        echo "Discovering services with TLS serving certs..."
+        TLS_SERVICES=$(oc get services -n "$NAMESPACE" \
+          -o jsonpath='{range .items[?(@.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name)]}{.metadata.name}{"\n"}{end}')
+
+        echo "TLS services found:"
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          echo "  $svc -> secret: $SECRET"
+        done
+
+        echo ""
+        echo "Waiting for TLS service pods to be ready..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SELECTOR=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o go-template='{{range $k,$v := .spec.selector}}{{$k}}={{$v}},{{end}}' | sed 's/,$//')
+          if [ -z "$SELECTOR" ]; then
+            echo "  SKIP: $svc has no selector"
+            continue
+          fi
+          echo "  $svc (selector: $SELECTOR)..."
+          if ! oc wait pods -l "$SELECTOR" -n "$NAMESPACE" \
+            --for=condition=Ready --timeout=5m; then
+            echo "  WARNING: pods for $svc did not become ready within 5m"
+            echo "  Pod status:"
+            oc get pods -l "$SELECTOR" -n "$NAMESPACE" --no-headers | sed 's/^/    /'
+            echo "  Recent events:"
+            oc get events -n "$NAMESPACE" --field-selector reason!=Pulling,reason!=Pulled \
+              --sort-by='.lastTimestamp' 2>/dev/null | grep "$svc" | tail -5 | sed 's/^/    /' \
+              || echo "    (no events found)"
+          fi
+        done
+
+        echo ""
+        echo "Verifying TLS secrets from service-ca..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          if oc get secret "$SECRET" -n "$NAMESPACE" &>/dev/null; then
+            echo "  $SECRET exists"
+          else
+            echo "  WARNING: $SECRET not found"
+          fi
+        done
+
+        echo ""
+        echo "Final pod status in $NAMESPACE:"
+        oc get pods -n "$NAMESPACE"
+      from: cli
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: ipi-aws
 - always_run: false
   as: markdownlint
   commands: |
diff --git a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-periodics.yaml b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-periodics.yaml
new file mode 100644
index 0000000000000..9c7bc0f810bf4
--- /dev/null
+++ b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-periodics.yaml
@@ -0,0 +1,90 @@
+periodics:
+- agent: kubernetes
+  cluster: build07
+  cron: 0 3 * * 5
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.must-gather
+    - bundle.Dockerfile
+  extra_refs:
+  - base_ref: main
+    org: openshift-kni
+    repo: oran-o2ims
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.must-gather
+    - bundle.Dockerfile
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-kni-oran-o2ims-main-install-bundle-tls-scan-periodic
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=install-bundle-tls-scan-periodic
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
diff --git a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml
index 5da5362f3911e..a28a94cc7ebe0 100644
--- a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml
@@ -255,6 +255,93 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build09
+    context: ci/prow/install-bundle-tls-scan
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - Dockerfile
+      - Dockerfile.must-gather
+      - bundle.Dockerfile
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-kni-oran-o2ims-main-install-bundle-tls-scan
+    optional: true
+    rerun_command: /test install-bundle-tls-scan
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=install-bundle-tls-scan
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )install-bundle-tls-scan,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:
diff --git a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-periodics.yaml b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-periodics.yaml
new file mode 100644
index 0000000000000..7a86f99988522
--- /dev/null
+++ b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-periodics.yaml
@@ -0,0 +1,90 @@
+periodics:
+- agent: kubernetes
+  cluster: build07
+  cron: 0 3 * * 1
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.must-gather
+    - bundle.Dockerfile
+  extra_refs:
+  - base_ref: release-4.22
+    org: openshift-kni
+    repo: oran-o2ims
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.must-gather
+    - bundle.Dockerfile
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-kni-oran-o2ims-release-4.22-install-bundle-tls-scan-periodic
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=install-bundle-tls-scan-periodic
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
diff --git a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-presubmits.yaml b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-presubmits.yaml
index e9bceba46507a..987ec7227c6a9 100644
--- a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-presubmits.yaml
+++ b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-presubmits.yaml
@@ -255,6 +255,93 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^release-4\.22$
+    - ^release-4\.22-
+    cluster: build09
+    context: ci/prow/install-bundle-tls-scan
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - Dockerfile
+      - Dockerfile.must-gather
+      - bundle.Dockerfile
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-kni-oran-o2ims-release-4.22-install-bundle-tls-scan
+    optional: true
+    rerun_command: /test install-bundle-tls-scan
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=install-bundle-tls-scan
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )install-bundle-tls-scan,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:
diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
index eb48bac978faa..cf89d9e816d48 100644
--- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
+++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
@@ -6,8 +6,14 @@ set -o pipefail
 run_tls_scan() {
 
   # TLS Scanner - scans TLS configurations of all pods in the cluster
-  local NAMESPACE="tls-scanner"
+  local NAMESPACE="${SCANNER_NAMESPACE:-tls-scanner}"
   local OWNS_NAMESPACE=true
+  # When SCANNER_NAMESPACE is explicitly set, deploy into an existing namespace
+  # (do not create/delete it). Check the variable itself, not the resolved value,
+  # so that SCANNER_NAMESPACE=tls-scanner is also treated as externally owned.
+  if [[ -n "${SCANNER_NAMESPACE:-}" ]]; then
+      OWNS_NAMESPACE=false
+  fi
   local SCANNER_IMAGE="${PULL_SPEC_TLS_SCANNER_TOOL}"
   local ARTIFACT_DIR="${ARTIFACT_DIR:-/tmp/artifacts}"
 
diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
index 37072ca16a889..f45025cb6f064 100644
--- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
+++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
@@ -7,6 +7,12 @@ ref:
   - name: SCAN_NAMESPACE
     default: ""
     documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces."
+  - name: SCANNER_NAMESPACE
+    default: ""
+    documentation: |-
+      Namespace where the scanner pod is deployed. When set, the scanner runs
+      in this existing namespace instead of creating a dedicated 'tls-scanner'
+      namespace.
   - name: PQC_CHECK
     default: "false"
     documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)."