diff --git a/packages/core/platform/sources/networking.yaml b/packages/core/platform/sources/networking.yaml
index 8e8485b30..bece76f8b 100644
--- a/packages/core/platform/sources/networking.yaml
+++ b/packages/core/platform/sources/networking.yaml
@@ -66,6 +66,7 @@ spec:
       path: system/cilium
       valuesFiles:
       - values.yaml
+      - values-apparmor.yaml
       install:
         privileged: true
         namespace: cozy-cilium
@@ -117,6 +118,7 @@ spec:
       path: system/cilium
       valuesFiles:
       - values.yaml
+      - values-apparmor.yaml
       - values-kubeovn.yaml
       install:
         privileged: true
diff --git a/packages/system/cilium/Makefile b/packages/system/cilium/Makefile
index 07d4ca972..71b47a77d 100644
--- a/packages/system/cilium/Makefile
+++ b/packages/system/cilium/Makefile
@@ -12,6 +12,15 @@ update:
 	helm repo update cilium
 	helm pull cilium/cilium --untar --untardir charts --version 1.19
 	$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
+	# Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent
+	# DaemonSet. Cozystack manages these annotations through cilium.podAnnotations
+	# in values.yaml on every k8s version, so keeping the upstream block would
+	# produce duplicate mapping keys on k8s<1.30.
+	perl -i -0pe 's|\n        \{\{- if not \.Values\.securityContext\.privileged \}\}\n        \{\{- if semverCompare "<1\.30\.0".*?\n        \{\{- end \}\}\n        \{\{- end \}\}\n        \{\{- end \}\}||s' \
+		charts/cilium/templates/cilium-agent/daemonset.yaml
+	@! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io' \
+		charts/cilium/templates/cilium-agent/daemonset.yaml || \
+		{ echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; }
 	version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
 	$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
 
diff --git a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
index f9a4cec72..fa3afc149 100644
--- a/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+++ b/packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
@@ -57,19 +57,6 @@ spec:
         # ensure pods roll when configmap updates
         cilium.io/cilium-configmap-checksum: {{ include (print $.Template.BasePath "/cilium-configmap.yaml") . | sha256sum | quote }}
         {{- end }}
-        {{- if not .Values.securityContext.privileged }}
-        {{- if semverCompare "<1.30.0" (printf "%d.%d.0" (semver .Capabilities.KubeVersion.Version).Major (semver .Capabilities.KubeVersion.Version).Minor) }}
-        # Set app AppArmor's profile to "unconfined". The value of this annotation
-        # can be modified as long users know which profiles they have available
-        # in AppArmor.
-        container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined"
-        container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined"
-        {{- if .Values.cgroup.autoMount.enabled }}
-        container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined"
-        container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined"
-        {{- end }}
-        {{- end }}
-        {{- end }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
diff --git a/packages/system/cilium/values-apparmor.yaml b/packages/system/cilium/values-apparmor.yaml
new file mode 100644
index 000000000..0712836cf
--- /dev/null
+++ b/packages/system/cilium/values-apparmor.yaml
@@ -0,0 +1,20 @@
+cilium:
+  # Opt out of the cri-containerd.apparmor.d profile for containers that invoke
+  # nsenter to join the host cgroup/mount namespace. The kernel reports the
+  # denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and
+  # other distros that load this AppArmor profile by default, where the
+  # denial otherwise puts cilium-agent into Init:CrashLoopBackOff.
+  # The deprecated annotations are used because k8s >= 1.30 pod-level
+  # appArmorProfile: Unconfined is not honoured by containerd CRI today
+  # (kubernetes/kubernetes#125069).
+  # Only applied on non-Talos cilium variants where cgroup.autoMount.enabled is
+  # true — on Talos mount-cgroup is not rendered and the kube-apiserver would
+  # reject an annotation referencing a non-existent container.
+  # mount-bpf-fs is intentionally excluded: it renders with its own
+  # securityContext.privileged=true, and the kernel does not apply AppArmor
+  # profiles to privileged containers.
+  podAnnotations:
+    container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
+    container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
+    container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
+    container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined