diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8190b5f..9a778be 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -96,6 +96,10 @@ jobs:
               - 'charts/shopware/**/*.yml'
               - 'charts/shopware/**/*.tpl'
               - 'charts/shopware/Chart.lock'
+              - 'charts/shopware-operator/**/*.yaml'
+              - 'charts/shopware-operator/**/*.yml'
+              - 'charts/shopware-operator/**/*.tpl'
+              - '.github/workflows/ci.yaml'
 
       - name: Set up Helm
         uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
@@ -112,6 +116,10 @@ jobs:
         run: |
           kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/standard-install.yaml
           kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/baremetal/deploy.yaml
+
+          kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.21.0/cert-manager.yaml
+          kubectl wait --namespace cert-manager --for=condition=Available --timeout=2m deployment/cert-manager deployment/cert-manager-cainjector deployment/cert-manager-webhook
+
           kubectl create namespace test
           kubectl create namespace test-template
           kubectl rollout status --namespace ingress-nginx deployment/ingress-nginx-controller --timeout=60s
@@ -156,12 +164,27 @@ jobs:
 
       - name: Run helm install
         run: |
-          helm install test --namespace test charts/shopware \
+          # The operator's Deployment can report condition=Available before its
+          # validating webhook (port 9443) is actually accepting connections,
+          # since readiness is only gated on /readyz (port 8081). Retry to
+          # absorb that startup race instead of failing the whole job on it.
+          n=0
+          until helm install test --namespace test charts/shopware \
             --set rustfs.storageclass.dataStorageSize=100Mi \
             --set rustfs.storageclass.logStorageSize=100Mi \
             --set valkeyapp.master.resources.requests.cpu=200m \
             --set valkeysession.master.resources.requests.cpu=200m \
             --set valkeyworker.master.resources.requests.cpu=200m
+          do
+            n=$((n+1))
+            if [ "$n" -ge 5 ]; then
+              echo "::error::helm install failed after $n attempts"
+              exit 1
+            fi
+            echo "helm install failed (attempt $n/5), retrying in 5s..."
+            helm uninstall test --namespace test || true
+            sleep 5
+          done
 
           kubectl wait --namespace test store/test --for='jsonpath={.status.state}'=setup --timeout=1m