diff --git a/packages/core/installer/templates/cozy-system-labels.yaml b/packages/core/installer/templates/cozy-system-labels.yaml
deleted file mode 100644
index 995e5e3ab..000000000
--- a/packages/core/installer/templates/cozy-system-labels.yaml
+++ /dev/null
@@ -1,111 +0,0 @@
-{{/*
-  Pre-install/upgrade hook that labels the cozy-system namespace with the
-  PodSecurity and cozystack identity labels. The chart no longer ships a
-  Namespace resource (helm v3 cannot adopt a namespace pre-created by
-  --create-namespace because it lacks helm meta annotations; without
-  --create-namespace, helm fails to write its release-secret because the
-  namespace does not exist yet — chicken-and-egg).
-  Install commands now use --create-namespace to bootstrap the namespace,
-  and this hook patches the labels the operator depends on (notably
-  pod-security.kubernetes.io/enforce=privileged for the host-network
-  operator pod).
-*/}}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cozy-system-labeler
-  namespace: cozy-system
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-200"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: cozy-system-labeler
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-180"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-rules:
-- apiGroups: [""]
-  resources: ["namespaces"]
-  resourceNames: ["cozy-system"]
-  verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cozy-system-labeler
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-160"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-subjects:
-- kind: ServiceAccount
-  name: cozy-system-labeler
-  namespace: cozy-system
-roleRef:
-  kind: ClusterRole
-  name: cozy-system-labeler
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: cozy-system-labeler
-  namespace: cozy-system
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-weight: "-100"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-spec:
-  backoffLimit: 3
-  ttlSecondsAfterFinished: 60
-  template:
-    spec:
-      serviceAccountName: cozy-system-labeler
-      restartPolicy: OnFailure
-      # The hook runs BEFORE Cilium / kube-ovn / any CNI is installed, so the
-      # cluster's nodes are NotReady-NoSchedule and have no pod network. Mirror
-      # the cozystack-operator deployment's scheduling: hostNetwork=true so the
-      # pod doesn't need CNI, plus the same tolerations the operator uses.
-      hostNetwork: true
-      tolerations:
-      - key: "node.kubernetes.io/not-ready"
-        operator: "Exists"
-      - key: "node.kubernetes.io/unreachable"
-        operator: "Exists"
-      - key: "node.cilium.io/agent-not-ready"
-        operator: "Exists"
-      - key: "node.cloudprovider.kubernetes.io/uninitialized"
-        operator: "Exists"
-      containers:
-      - name: kubectl
-        image: alpine/k8s:1.32.0
-        imagePullPolicy: IfNotPresent
-        {{- if eq .Values.cozystackOperator.variant "talos" }}
-        env:
-        # Talos KubePrism endpoint — same as cozystack-operator uses to reach
-        # the apiserver before CNI is up.
-        - name: KUBERNETES_SERVICE_HOST
-          value: "localhost"
-        - name: KUBERNETES_SERVICE_PORT
-          value: "7445"
-        {{- else if eq .Values.cozystackOperator.variant "generic" }}
-        env:
-        - name: KUBERNETES_SERVICE_HOST
-          value: {{ required "cozystack.apiServerHost is required in generic mode" .Values.cozystack.apiServerHost | quote }}
-        - name: KUBERNETES_SERVICE_PORT
-          value: {{ .Values.cozystack.apiServerPort | quote }}
-        {{- end }}
-        command:
-        - kubectl
-        - label
-        - --overwrite
-        - namespace
-        - cozy-system
-        - cozystack.io/system=true
-        - pod-security.kubernetes.io/enforce=privileged