diff --git a/pkg/webhooks/regularuser/common/regularuser.go b/pkg/webhooks/regularuser/common/regularuser.go
index 780178ae..35b6d72a 100644
--- a/pkg/webhooks/regularuser/common/regularuser.go
+++ b/pkg/webhooks/regularuser/common/regularuser.go
@@ -54,6 +54,15 @@ var (
 		"system:serviceaccount:openshift-cluster-node-tuning-operator:cluster-node-tuning-operator",
 		"system:serviceaccount:openshift-machine-config-operator:machine-config-controller",
 		"system:admin",
+		// The OpenShift Sandboxed Containers operator creates/modifies MachineConfig
+		// resources when a KataConfig is reconciled. Its CSV currently runs the
+		// controller as the `default` ServiceAccount in the fixed
+		// `openshift-sandboxed-containers-operator` namespace, so this entry matches
+		// the complete Kubernetes identity (namespace + ServiceAccount) and does not
+		// wildcard other namespaces or service accounts. A future dedicated OSC
+		// ServiceAccount may coexist with this entry; remove it only once no
+		// supported OSC version still relies on this identity.
+		"system:serviceaccount:openshift-sandboxed-containers-operator:default",
 	}
 	ceeGroup = "system:serviceaccounts:openshift-backplane-cee"
 
diff --git a/pkg/webhooks/regularuser/common/regularuser_test.go b/pkg/webhooks/regularuser/common/regularuser_test.go
index 2a681b18..c47953c0 100644
--- a/pkg/webhooks/regularuser/common/regularuser_test.go
+++ b/pkg/webhooks/regularuser/common/regularuser_test.go
@@ -272,6 +272,44 @@ func TestMachineConfig(t *testing.T) {
 			operation:       admissionv1.Create,
 			shouldBeAllowed: false,
 		},
+		{
+			// OSC operator uses the `default` SA in the fixed
+			// openshift-sandboxed-containers-operator namespace (ROSAENG-61186).
+			testID:          "machineconfig-osc-serviceaccount",
+			targetResource:  "machineconfigs",
+			targetKind:      "MachineConfig",
+			targetVersion:   "v1",
+			targetGroup:     "machineconfiguration.openshift.io",
+			username:        "system:serviceaccount:openshift-sandboxed-containers-operator:default",
+			userGroups:      []string{"system:authenticated", "system:serviceaccounts", "system:serviceaccounts:openshift-sandboxed-containers-operator"},
+			operation:       admissionv1.Create,
+			shouldBeAllowed: true,
+		},
+		{
+			// The exception is scoped to the exact identity: the same `default` SA
+			// in a different namespace must remain denied.
+			testID:          "machineconfig-osc-serviceaccount-wrong-namespace",
+			targetResource:  "machineconfigs",
+			targetKind:      "MachineConfig",
+			targetVersion:   "v1",
+			targetGroup:     "machineconfiguration.openshift.io",
+			username:        "system:serviceaccount:some-other-namespace:default",
+			userGroups:      []string{"system:authenticated", "system:serviceaccounts", "system:serviceaccounts:some-other-namespace"},
+			operation:       admissionv1.Create,
+			shouldBeAllowed: false,
+		},
+		{
+			// A different SA within the OSC namespace must remain denied.
+			testID:          "machineconfig-osc-serviceaccount-wrong-sa",
+			targetResource:  "machineconfigs",
+			targetKind:      "MachineConfig",
+			targetVersion:   "v1",
+			targetGroup:     "machineconfiguration.openshift.io",
+			username:        "system:serviceaccount:openshift-sandboxed-containers-operator:some-other-sa",
+			userGroups:      []string{"system:authenticated", "system:serviceaccounts", "system:serviceaccounts:openshift-sandboxed-containers-operator"},
+			operation:       admissionv1.Create,
+			shouldBeAllowed: false,
+		},
 	}
 	runRegularuserTests(t, tests)
 }