diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 880ffe65c..ddd9a00d4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -15,7 +15,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version-file: kagenti-webhook/go.mod
 
       - name: Lint
         run: find . -type f -name 'go.mod' -execdir go fmt ./... \;
diff --git a/kagenti-webhook/internal/webhook/injector/pod_mutator.go b/kagenti-webhook/internal/webhook/injector/pod_mutator.go
index 1ccf0e1ec..58c1b9096 100644
--- a/kagenti-webhook/internal/webhook/injector/pod_mutator.go
+++ b/kagenti-webhook/internal/webhook/injector/pod_mutator.go
@@ -325,8 +325,12 @@ func (m *PodMutator) InjectSidecarsWithSpireOption(podSpec *corev1.PodSpec, name
 	}
 
 	// Check and inject client-registration sidecar (with SPIRE option)
-	if !containerExists(podSpec.Containers, ClientRegistrationContainerName) {
-		podSpec.Containers = append(podSpec.Containers, m.Builder.BuildClientRegistrationContainerWithSpireOption(crName, namespace, spireEnabled))
+	if m.EnableClientRegistration {
+		if !containerExists(podSpec.Containers, ClientRegistrationContainerName) {
+			podSpec.Containers = append(podSpec.Containers, m.Builder.BuildClientRegistrationContainerWithSpireOption(crName, namespace, spireEnabled))
+		}
+	} else {
+		mutatorLog.Info("Skipping client-registration injection (disabled via --enable-client-registration=false)")
 	}
 
 	// Check and inject envoy-proxy sidecar
diff --git a/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go b/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go
index c0896b31b..83b4e6882 100644
--- a/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go
+++ b/kagenti-webhook/internal/webhook/v1alpha1/authbridge_webhook.go
@@ -167,10 +167,19 @@ func (w *AuthBridgeWebhook) Handle(ctx context.Context, req admission.Request) a
 }
 
 func (w *AuthBridgeWebhook) isAlreadyInjected(podSpec *corev1.PodSpec) bool {
+	// Check sidecar containers (envoy-proxy is always injected by the AuthBridge path,
+	// so it serves as a reliable marker even when spiffe-helper and client-registration
+	// are both disabled via their respective flags)
 	for _, container := range podSpec.Containers {
-		if container.Name == injector.SpiffeHelperContainerName ||
-			container.Name == injector.ClientRegistrationContainerName ||
-			container.Name == injector.EnvoyProxyContainerName {
+		if container.Name == injector.EnvoyProxyContainerName ||
+			container.Name == injector.SpiffeHelperContainerName ||
+			container.Name == injector.ClientRegistrationContainerName {
+			return true
+		}
+	}
+	// Also check init containers — proxy-init is always injected by InjectAuthBridge
+	for _, container := range podSpec.InitContainers {
+		if container.Name == injector.ProxyInitContainerName {
 			return true
 		}
 	}