diff --git a/build/openshift/kiali.mk b/build/openshift/kiali.mk
index 01222360d..d9317bbb1 100644
--- a/build/openshift/kiali.mk
+++ b/build/openshift/kiali.mk
@@ -43,6 +43,9 @@ BOOKINFO_TRAFFIC_ROUTE ?= http://productpage.$(BOOKINFO_NAMESPACE).svc.cluster.l
 # Final health check through Kiali API after Bookinfo is installed.
 BOOKINFO_KIALI_CLUSTER_NAME ?= Kubernetes
 BOOKINFO_HEALTH_WORKLOAD ?= productpage-v1
+# Untracked OpenShift overlay (lexically after kiali.toml) written by
+# write-kiali-mcp-config-openshift. Tracked kiali.toml stays Kind/CI localhost.
+KIALI_MCP_CONFIG_OPENSHIFT ?= $(abspath $(CURDIR)/dev/config/mcp-configs/zz-kiali-openshift.toml)
 # install-bookinfo-demo.sh: extra flags only (-ail is set from detected revision in the recipe).
 # -tg installs Kiali traffic generator (OpenShift routes must exist; script waits after expose).
 BOOKINFO_SCRIPT_EXTRA ?= -tg
@@ -123,12 +126,105 @@ setup-kiali-openshift: ## OpenShift: OSSM/Sail + Istio/Kiali + Bookinfo (Kiali h
 	fi
 	@echo "==> Kiali: checking version ..."
 	bash '$(OSSM_INSTALL_SCRIPT)' -c '$(KUBERNETES_CLI)' install-kiali-support
+	@$(MAKE) -s fix-istiod-validating-webhook
 	@$(MAKE) -s install-bookinfo-openshift
 	@$(MAKE) -s validate-bookinfo-kiali-health
+	@$(MAKE) -s write-kiali-mcp-config-openshift
 	@echo "==> Bookinfo: OpenShift routes (productpage / gateways):"
 	@'$(KUBERNETES_CLI)' get route -n '$(BOOKINFO_NAMESPACE)' 2>/dev/null || true
 	@echo "==> setup-kiali-openshift: done."
 
+# Discover the Kiali OpenShift Route and write an untracked drop-in that
+# overrides tracked kiali.toml (lexical order: zz-kiali-openshift.toml).
+# Same MCP_CONFIG_DIR as CI; do not git add this file. Remove it manually
+# before Kind/CI local runs if you need localhost:20001 again.
+# Probes /kiali vs root (Sail often has no /kiali).
+.PHONY: write-kiali-mcp-config-openshift
+write-kiali-mcp-config-openshift: ## OpenShift: write Kiali Route URL into $(KIALI_MCP_CONFIG_OPENSHIFT)
+	@set -e; \
+	client='$(KUBERNETES_CLI)'; \
+	cpns='$(BOOKINFO_CP_NAMESPACE)'; \
+	out='$(KIALI_MCP_CONFIG_OPENSHIFT)'; \
+	kiali_host="$$( $$client -n "$$cpns" get route kiali -o jsonpath='{.spec.host}' 2>/dev/null || true )"; \
+	if [ -z "$$kiali_host" ]; then \
+	  echo "Kiali route not found in namespace $$cpns; cannot write $$out" >&2; \
+	  exit 1; \
+	fi; \
+	kiali_token="$$( $$client whoami -t 2>/dev/null || true )"; \
+	base_root="https://$$kiali_host/"; \
+	base_kiali="https://$$kiali_host/kiali/"; \
+	probe_root="https://$$kiali_host/api"; \
+	probe_kiali="https://$$kiali_host/kiali/api"; \
+	base_url=""; \
+	curl_cfg=""; \
+	trap 'rm -f "$$curl_cfg"' EXIT; \
+	if [ -n "$$kiali_token" ]; then \
+	  curl_cfg="$$(mktemp)"; \
+	  chmod 600 "$$curl_cfg"; \
+	  printf 'header = "Authorization: Bearer %s"\n' "$$kiali_token" > "$$curl_cfg"; \
+	  code_kiali="$$(curl -ksS -o /dev/null -w '%{http_code}' --max-time 15 -K "$$curl_cfg" "$$probe_kiali" 2>/dev/null || echo 000)"; \
+	  code_root="$$(curl -ksS -o /dev/null -w '%{http_code}' --max-time 15 -K "$$curl_cfg" "$$probe_root" 2>/dev/null || echo 000)"; \
+	  rm -f "$$curl_cfg"; \
+	  curl_cfg=""; \
+	else \
+	  code_kiali="$$(curl -ksS -o /dev/null -w '%{http_code}' --max-time 15 "$$probe_kiali" 2>/dev/null || echo 000)"; \
+	  code_root="$$(curl -ksS -o /dev/null -w '%{http_code}' --max-time 15 "$$probe_root" 2>/dev/null || echo 000)"; \
+	fi; \
+	: "Prefer base_root when both probes succeed (Sail serves at /); base_kiali only if root fails"; \
+	case "$$code_root" in \
+	  2*|3*) base_url="$$base_root" ;; \
+	  *) \
+	    case "$$code_kiali" in \
+	      2*|3*) base_url="$$base_kiali" ;; \
+	      *) \
+	        echo "Neither $$probe_root (HTTP $$code_root) nor $$probe_kiali (HTTP $$code_kiali) responded OK; defaulting to $$base_root" >&2; \
+	        base_url="$$base_root"; \
+	        ;; \
+	    esac; \
+	    ;; \
+	esac; \
+	mkdir -p "$$(dirname "$$out")"; \
+	printf '%s\n' \
+	  '[toolset_configs.kiali]' \
+	  '# Generated by make write-kiali-mcp-config-openshift / setup-kiali-openshift.' \
+	  '# Untracked overlay; overrides tracked kiali.toml. Do not git add.' \
+	  "url = \"$$base_url\"" \
+	  'insecure = true' \
+	  > "$$out"; \
+	echo "==> Wrote Kiali MCP overlay: $$out"; \
+	echo "    url = $$base_url"
+
+# Sail's IstioRevisionTag webhook (istiod-default-validator) targets Service
+# "istiod", but revisioned installs only create istiod-<rev>. Without an alias
+# Service + matching CA bundle, creating VirtualServices/DestinationRules fails
+# with: service "istiod" not found / x509 unknown authority. Needed for Bookinfo
+# and for kiali eval setup scripts that apply Istio CRs.
+.PHONY: fix-istiod-validating-webhook
+fix-istiod-validating-webhook: ## OpenShift/Sail: alias Service istiod + sync webhook CA for validation.istio.io
+	@set -e; \
+	cli='$(KUBERNETES_CLI)'; \
+	ns='$(BOOKINFO_CP_NAMESPACE)'; \
+	rev_svc="$$( $$cli get svc -n "$$ns" -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | awk '/^istiod-default-v/{print; exit}' )"; \
+	if [ -z "$$rev_svc" ]; then \
+	  echo "==> fix-istiod-validating-webhook: no istiod-default-v* Service in $$ns; skip"; \
+	  exit 0; \
+	fi; \
+	echo "==> fix-istiod-validating-webhook: ensuring Service/istiod aliases $$rev_svc"; \
+	$$cli get svc "$$rev_svc" -n "$$ns" -o json | \
+	  jq 'del(.metadata.resourceVersion,.metadata.uid,.metadata.creationTimestamp,.metadata.managedFields,.metadata.ownerReferences,.metadata.annotations,.metadata.labels,.status,.spec.clusterIP,.spec.clusterIPs) | .metadata.name="istiod" | .metadata.annotations={"mcp.local/alias-for": $$rev}' --arg rev "$$rev_svc" | \
+	  $$cli apply -f -; \
+	if $$cli get validatingwebhookconfiguration istiod-default-validator >/dev/null 2>&1; then \
+	  wh_rev="$$( $$cli get validatingwebhookconfiguration -o name | awk -F/ '/istio-validator-default-v/{print $$2; exit}' )"; \
+	  if [ -n "$$wh_rev" ]; then \
+	    ca="$$( $$cli get validatingwebhookconfiguration "$$wh_rev" -o jsonpath='{.webhooks[0].clientConfig.caBundle}' )"; \
+	    if [ -n "$$ca" ]; then \
+	      $$cli patch validatingwebhookconfiguration istiod-default-validator --type=json \
+	        -p="[{\"op\":\"replace\",\"path\":\"/webhooks/0/clientConfig/service/name\",\"value\":\"istiod\"},{\"op\":\"replace\",\"path\":\"/webhooks/0/clientConfig/caBundle\",\"value\":\"$$ca\"}]"; \
+	      echo "==> fix-istiod-validating-webhook: patched istiod-default-validator CA from $$wh_rev"; \
+	    fi; \
+	  fi; \
+	fi
+
 OSSM_DELETE_NAMESPACES ?= yes
 
 .PHONY: clean-kiali-openshift