diff --git a/packages/apps/kubernetes/templates/oidc-rbac-job.yaml b/packages/apps/kubernetes/templates/oidc-rbac-job.yaml
index 2b478dbaf..64b6792ce 100644
--- a/packages/apps/kubernetes/templates/oidc-rbac-job.yaml
+++ b/packages/apps/kubernetes/templates/oidc-rbac-job.yaml
@@ -300,10 +300,11 @@ spec:
                 CA_DATA=$(kubectl --kubeconfig "$KUBECONFIG_TENANT" config view --raw \
                   --output=jsonpath='{.clusters[0].cluster.certificate-authority-data}')
                 if [ -z "$CA_DATA" ]; then
-                  echo "WARNING: tenant admin kubeconfig has no certificate-authority-data; leaving OIDC kubeconfig Secret as the install-time placeholder" >&2
-                else
-                  KUBECONFIG_FILE=$(mktemp)
-                  cat > "$KUBECONFIG_FILE" <<EOF
+                  echo "tenant admin kubeconfig has no certificate-authority-data; refusing to leave the OIDC kubeconfig Secret as the install-time placeholder" >&2
+                  exit 1
+                fi
+                KUBECONFIG_FILE=$(mktemp)
+                cat > "$KUBECONFIG_FILE" <<EOF
               apiVersion: v1
               kind: Config
               current-context: $RELEASE
@@ -334,14 +335,13 @@ spec:
                   cluster: $RELEASE
                   user: $RELEASE-oidc
               EOF
-                  KUBECONFIG_B64=$(base64 < "$KUBECONFIG_FILE" | tr -d '\n')
-                  PATCH=$(printf '{"data":{"kubeconfig":"%s"},"stringData":null}' "$KUBECONFIG_B64")
-                  kubectl --namespace "$RELEASE_NAMESPACE" patch secret \
-                    "$RELEASE-oidc-kubeconfig" \
-                    --type=merge \
-                    --patch "$PATCH"
-                  rm -f "$KUBECONFIG_FILE"
-                fi
+                KUBECONFIG_B64=$(base64 < "$KUBECONFIG_FILE" | tr -d '\n')
+                PATCH=$(printf '{"data":{"kubeconfig":"%s"},"stringData":null}' "$KUBECONFIG_B64")
+                kubectl --namespace "$RELEASE_NAMESPACE" patch secret \
+                  "$RELEASE-oidc-kubeconfig" \
+                  --type=merge \
+                  --patch "$PATCH"
+                rm -f "$KUBECONFIG_FILE"
               fi
 
               echo "Done."
diff --git a/packages/apps/kubernetes/tests/oidc_test.yaml b/packages/apps/kubernetes/tests/oidc_test.yaml
index ebcd6bf1c..106b814b0 100644
--- a/packages/apps/kubernetes/tests/oidc_test.yaml
+++ b/packages/apps/kubernetes/tests/oidc_test.yaml
@@ -2593,6 +2593,29 @@ tests:
           pattern: 'name: view'
         documentIndex: 3
 
+  - it: mode=System aborts the Job instead of leaving the OIDC kubeconfig Secret as the install-time placeholder when the tenant CA is missing
+    # A placeholder kubeconfig cannot authenticate, so the release must not go Ready with it.
+    release:
+      name: kubernetes-app
+      namespace: tenant-foo
+    template: templates/oidc-rbac-job.yaml
+    set:
+      _cluster.oidc-enabled: "true"
+      _cluster.root-host: example.org
+      oidc.mode: System
+      oidc.users:
+        - email: alice@example.org
+          role: admin
+    asserts:
+      - notMatchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'WARNING:.*leaving OIDC kubeconfig Secret as the install-time placeholder'
+        documentIndex: 3
+      - matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'if \[ -z "\$CA_DATA" \]; then\n\s+echo "tenant admin kubeconfig has no certificate-authority-data; refusing to leave the OIDC kubeconfig Secret as the install-time placeholder" >&2\n\s+exit 1\n\s+fi'
+        documentIndex: 3
+
   ###############################################
   # mode: CustomConfig                          #
   ###############################################