diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go
index ae643d65241..3260983a502 100644
--- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go
+++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go
@@ -117,7 +117,7 @@ func generateConfig(p KubeAPIServerConfigParams) (*kcpv1.KubeAPIServerConfig, er
 									Kind:       "PodSecurityConfiguration",
 								},
 								Defaults: podsecurityadmissionv1.PodSecurityDefaults{
-									Enforce:        "restricted",
+									Enforce:        "privileged",
 									EnforceVersion: "latest",
 									Audit:          "restricted",
 									AuditVersion:   "latest",