diff --git a/Makefile b/Makefile
index 93d5029..c057dbf 100644
--- a/Makefile
+++ b/Makefile
@@ -62,6 +62,7 @@ ai-serving-deploy-existing-openshift: ## Deploy AI serving on existing OpenShift
 		--namespace $(AI_NAMESPACE) --create-namespace \
 		-f $(DEPLOY_VALUES_DIR)/values-platform-config.yaml \
 		--set namespace=$(AI_NAMESPACE) \
+		--set pca-guardrails.namespace=$(AI_NAMESPACE) \
 		--set hfToken.raw=$(HF_TOKEN) \
 		$(MCP_FLAGS)
 	helm upgrade --install $(AI_NAMESPACE)-ai-serving $(CHARTS_DIR)/pca-ai-serving \
@@ -90,13 +91,16 @@ devspace-deploy-existing-openshift: ## Deploy a devspace (DEV_NAMESPACE=, AI_NAM
 		oc annotate namespace $(DEV_NAMESPACE) \
 			che.eclipse.org/username=$(DEV_USER) --overwrite; \
 	fi
+	$(eval SKIP_OPENCODE_BUILD := $(if $(filter-out continue,$(TYPE)),\
+	  $(shell oc get buildconfig devspaces-opencode -n opencode-build --no-headers --ignore-not-found | grep -q . && echo true),))
 	helm upgrade --install $(DEV_NAMESPACE)-devspaces $(CHARTS_DIR)/pca-devspaces \
 		--namespace $(DEV_NAMESPACE) --create-namespace \
 		$(if $(filter continue,$(TYPE)),-f $(DEPLOY_VALUES_DIR)/values-devspaces-continue.yaml,-f $(DEPLOY_VALUES_DIR)/values-devspaces.yaml) \
 		--set aiServingNamespace=$(AI_NAMESPACE) \
 		--set devspaces[0].user=$(DEV_USER) \
 		$(if $(filter true,$(MCP_ENABLED)),--set mcp.enabled=true,) \
-		$(HELM_ARGS)
+		$(HELM_ARGS) \
+		$(if $(filter true,$(SKIP_OPENCODE_BUILD)),--set opencodeBuild.enabled=false,)
 
 devspace-undeploy-existing-openshift: ## Remove a devspace (DEV_NAMESPACE=)
 	@if [ -z "$(DEV_NAMESPACE)" ]; then echo "ERROR: DEV_NAMESPACE is required. Pass DEV_NAMESPACE=<name>"; exit 1; fi
diff --git a/charts/pca-devspaces/templates/opencode-image-build.yaml b/charts/pca-devspaces/templates/opencode-image-build.yaml
index b0959a2..1cf2b83 100644
--- a/charts/pca-devspaces/templates/opencode-image-build.yaml
+++ b/charts/pca-devspaces/templates/opencode-image-build.yaml
@@ -14,6 +14,7 @@ metadata:
   name: opencode-build
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+    helm.sh/resource-policy: keep
 ---
 apiVersion: image.openshift.io/v1
 kind: ImageStream
@@ -22,6 +23,7 @@ metadata:
   namespace: opencode-build
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+    helm.sh/resource-policy: keep
 ---
 apiVersion: build.openshift.io/v1
 kind: BuildConfig
@@ -30,6 +32,7 @@ metadata:
   namespace: opencode-build
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+    helm.sh/resource-policy: keep
 spec:
   output:
     to:
@@ -70,6 +73,7 @@ metadata:
   namespace: opencode-build
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+    helm.sh/resource-policy: keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -86,6 +90,7 @@ metadata:
   namespace: opencode-build
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+    helm.sh/resource-policy: keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/deploy_existing_openshift/README.md b/deploy_existing_openshift/README.md
index a1b98da..f758cf3 100644
--- a/deploy_existing_openshift/README.md
+++ b/deploy_existing_openshift/README.md
@@ -47,6 +47,10 @@ make devspace-deploy-existing-openshift DEV_NAMESPACE=hadar-devspaces DEV_USER=h
   HELM_ARGS='--set devspacesGlobalConfig.enabled=false'
 ```
 
+> **OpenCode build:** `opencode-build` is cluster-singleton infrastructure owned by the first Helm release. The Makefile auto-detects whether it already exists and suppresses `opencodeBuild` for subsequent runs. If deploying manually with `helm upgrade --install`, pass `--set opencodeBuild.enabled=false` from the second developer onward.
+>
+> **Do not uninstall** the release that owns `opencode-build` while other OpenCode workspaces exist — doing so deletes the BuildConfig and ImageStream (the Namespace is kept), breaking image pulls for all running workspaces. Recovery: delete the empty namespace (`oc delete namespace opencode-build`), then re-run any opencode devspace deploy without `--set opencodeBuild.enabled=false` to recreate the full build infrastructure.
+
 ## Parameters
 
 | Variable | Default | Used by | Notes |
@@ -64,6 +68,7 @@ make devspace-deploy-existing-openshift DEV_NAMESPACE=hadar-devspaces DEV_USER=h
 | Flag | When |
 |------|------|
 | `--set devspacesGlobalConfig.enabled=false` | 2nd+ developer (avoid Helm ownership of global ConfigMaps in `openshift-devspaces`) |
+| `--set opencodeBuild.enabled=false` | 2nd+ opencode developer — avoids Helm ownership conflict on the shared `opencode-build` namespace (Makefile detects this automatically) |
 | `--set pca-observability.langfuse.enabled=true` | Opt in Langfuse (+ OTel) with AI serving |
 | `--set guardrails.enabled=true --set guardrails.endpoint=http://guardrails-proxy.<AI_NS>.svc.cluster.local:8080` | Route IDE chat through guardrails on a devspace |
 | `--set aiGateway.escapeHatchToLlmd=true` | Skip RHCL; IDEs call llm-d Gateway directly |
diff --git a/deploy_existing_openshift/values-platform-config.yaml b/deploy_existing_openshift/values-platform-config.yaml
index b4827bb..2e85093 100644
--- a/deploy_existing_openshift/values-platform-config.yaml
+++ b/deploy_existing_openshift/values-platform-config.yaml
@@ -22,7 +22,7 @@ devspaces:
 # Guardrails sub-chart config. Set guardrails.enabled: true in the parent to enable.
 # To add secret patterns, append regex to pca-guardrails.guardrails.detectors.secretsRegex.patterns.
 pca-guardrails:
-  namespace: hacohen-ai-coder
+  namespace: ai-serving
   guardrails:
     enforcement: block
     llmService: