diff --git a/internal/deployer/deployer.go b/internal/deployer/deployer.go
index 96eaef3e..1b9f66c2 100644
--- a/internal/deployer/deployer.go
+++ b/internal/deployer/deployer.go
@@ -584,7 +584,6 @@ func (d *Deployer) ensureNamespaceExists(namespace string) error {
 	}
 
 	d.logger.Infof("Creating namespace %s", namespace)
-
 	_, err := d.runKubectl(context.Background(), KubectlOptions{
 		Args: []string{"create", "namespace", namespace},
 	})
@@ -592,6 +591,15 @@ func (d *Deployer) ensureNamespaceExists(namespace string) error {
 		return fmt.Errorf("failed to create namespace: %w", err)
 	}
 
+	// Label namespace as managed by roxie since we just created it
+	_, err = d.runKubectl(context.Background(), KubectlOptions{
+		Args: []string{"label", "namespace", namespace,
+			"app.kubernetes.io/managed-by=roxie", "--overwrite"},
+	})
+	if err != nil {
+		d.logger.Warningf("failed to label namespace %s: %v", namespace, err)
+	}
+
 	return nil
 }
 
diff --git a/tests/e2e/basic_test.go b/tests/e2e/basic_test.go
index 4724821b..3129b840 100644
--- a/tests/e2e/basic_test.go
+++ b/tests/e2e/basic_test.go
@@ -28,12 +28,14 @@ func TestDeployBothSimple(t *testing.T) {
 	args := append([]string{roxieBinary, "deploy", "--early-readiness", "both", "--envrc", envrcPath}, commonDeployArgsNoPortForward...)
 	runCommand(t, deployTimeout*2, nil, args...)
 
-	// Verify namespaces exist
+	// Verify namespaces exist and have managed-by labels
 	t.Log("Verifying namespace: acs-central")
 	verifyNamespaceExists(t, "acs-central")
+	verifyNamespaceHasLabel(t, "acs-central", "app.kubernetes.io/managed-by", "roxie")
 
 	t.Log("Verifying namespace: acs-sensor")
 	verifyNamespaceExists(t, "acs-sensor")
+	verifyNamespaceHasLabel(t, "acs-sensor", "app.kubernetes.io/managed-by", "roxie")
 
 	// Brief pause before cleanup
 	time.Sleep(5 * time.Second)
diff --git a/tests/e2e/e2e_test.go b/tests/e2e/e2e_test.go
index c4a8887a..27e7729f 100644
--- a/tests/e2e/e2e_test.go
+++ b/tests/e2e/e2e_test.go
@@ -196,6 +196,22 @@ func verifyNamespaceExists(t *testing.T, namespace string) {
 	}
 }
 
+func verifyNamespaceHasLabel(t *testing.T, namespace, key, value string) {
+	t.Helper()
+
+	cmd := exec.Command("kubectl", "get", "namespace", namespace,
+		"-o", "jsonpath={.metadata.labels['"+key+"']}")
+	output, err := cmd.Output()
+	if err != nil {
+		t.Fatalf("Failed to get label %s from namespace %s: %v", key, namespace, err)
+	}
+
+	actualValue := strings.TrimSpace(string(output))
+	if actualValue != value {
+		t.Fatalf("Namespace %s has label %s=%s, expected %s", namespace, key, actualValue, value)
+	}
+}
+
 func doesDeploymentExist(t *testing.T, namespace string, name string) bool {
 	t.Helper()
 
@@ -272,12 +288,14 @@ func TestDeployCentralAndSecuredCluster(t *testing.T) {
 	args = append([]string{roxieBinary, "deploy", "--early-readiness", "secured-cluster"}, commonDeployArgsNoPortForward...)
 	runCommand(t, deployTimeout, envrcEnv, args...)
 
-	// Verify namespaces
+	// Verify namespaces and labels
 	t.Log("Verifying namespace: acs-central")
 	verifyNamespaceExists(t, "acs-central")
+	verifyNamespaceHasLabel(t, "acs-central", "app.kubernetes.io/managed-by", "roxie")
 
 	t.Log("Verifying namespace: acs-sensor")
 	verifyNamespaceExists(t, "acs-sensor")
+	verifyNamespaceHasLabel(t, "acs-sensor", "app.kubernetes.io/managed-by", "roxie")
 
 	// Brief pause before next test
 	time.Sleep(5 * time.Second)
@@ -350,9 +368,11 @@ func TestDeployBothComponentsTogether(t *testing.T) {
 
 	t.Log("Verifying namespace: acs-central")
 	verifyNamespaceExists(t, "acs-central")
+	verifyNamespaceHasLabel(t, "acs-central", "app.kubernetes.io/managed-by", "roxie")
 
 	t.Log("Verifying namespace: acs-sensor")
 	verifyNamespaceExists(t, "acs-sensor")
+	verifyNamespaceHasLabel(t, "acs-sensor", "app.kubernetes.io/managed-by", "roxie")
 
 	// Verify Central has the pause-reconcile annotation.
 	t.Log("Verifying pause-reconcile annotation on Central CR")
@@ -420,9 +440,11 @@ func TestDeployCentralAndSecuredClusterViaHelm(t *testing.T) {
 
 	t.Log("Verifying namespace: acs-central")
 	verifyNamespaceExists(t, "acs-central")
+	verifyNamespaceHasLabel(t, "acs-central", "app.kubernetes.io/managed-by", "roxie")
 
 	t.Log("Verifying namespace: acs-sensor")
 	verifyNamespaceExists(t, "acs-sensor")
+	verifyNamespaceHasLabel(t, "acs-sensor", "app.kubernetes.io/managed-by", "roxie")
 }
 
 func verifyAnnotation(t *testing.T, resourceType, resourceName, namespace, annotationKey, expectedValue string) {