diff --git a/pkg/imports/admission/calico/embed.go b/pkg/imports/admission/calico/embed.go
new file mode 100644
index 0000000000..e5afc05e5e
--- /dev/null
+++ b/pkg/imports/admission/calico/embed.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package admission serves the generated admission policies to the components
+// that install them, so nothing has to keep a copy of its own.
+package admission
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed *.yaml
+var crds embed.FS
+
+// FS returns the admission policy YAML in this directory.
+func FS() fs.FS {
+	return crds
+}
diff --git a/pkg/imports/admission/enterprise/embed.go b/pkg/imports/admission/enterprise/embed.go
new file mode 100644
index 0000000000..e5afc05e5e
--- /dev/null
+++ b/pkg/imports/admission/enterprise/embed.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package admission serves the generated admission policies to the components
+// that install them, so nothing has to keep a copy of its own.
+package admission
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed *.yaml
+var crds embed.FS
+
+// FS returns the admission policy YAML in this directory.
+func FS() fs.FS {
+	return crds
+}
diff --git a/pkg/imports/crds/calico/v1.crd.projectcalico.org/embed.go b/pkg/imports/crds/calico/v1.crd.projectcalico.org/embed.go
new file mode 100644
index 0000000000..405a0d30d5
--- /dev/null
+++ b/pkg/imports/crds/calico/v1.crd.projectcalico.org/embed.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package crd serves the generated crd.projectcalico.org CRDs to the components
+// that install them, so nothing has to keep a copy of its own.
+package crd
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed *.yaml
+var crds embed.FS
+
+// FS returns the CRD YAML generated into this directory.
+func FS() fs.FS {
+	return crds
+}
diff --git a/pkg/imports/crds/calico/v3.projectcalico.org/embed.go b/pkg/imports/crds/calico/v3.projectcalico.org/embed.go
new file mode 100644
index 0000000000..c8057fcb43
--- /dev/null
+++ b/pkg/imports/crds/calico/v3.projectcalico.org/embed.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package crd serves the generated projectcalico.org v3 CRDs to the components
+// that install them, so nothing has to keep a copy of its own.
+package crd
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed *.yaml
+var crds embed.FS
+
+// FS returns the CRD YAML generated into this directory.
+func FS() fs.FS {
+	return crds
+}
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
index 27ef9631b8..0df7c0d870 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
@@ -360,7 +360,6 @@ spec:
                       enum:
                         - Compliant
                         - Warning
-                        - Degraded
                         - Critical
                       type: string
                     status:
diff --git a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
index 489f8fa1b2..afff28d6d7 100644
--- a/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
+++ b/pkg/imports/crds/enterprise/applicationlayer.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
@@ -185,7 +185,6 @@ spec:
                   enum:
                     - Compliant
                     - Warning
-                    - Degraded
                     - Critical
                   type: string
                 validationResults:
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
index 27ef9631b8..0df7c0d870 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafpolicies.yaml
@@ -360,7 +360,6 @@ spec:
                       enum:
                         - Compliant
                         - Warning
-                        - Degraded
                         - Critical
                       type: string
                     status:
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
index 489f8fa1b2..afff28d6d7 100644
--- a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/applicationlayer.projectcalico.org_wafvalidationpolicies.yaml
@@ -185,7 +185,6 @@ spec:
                   enum:
                     - Compliant
                     - Warning
-                    - Degraded
                     - Critical
                   type: string
                 validationResults:
diff --git a/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/embed.go b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/embed.go
new file mode 100644
index 0000000000..405a0d30d5
--- /dev/null
+++ b/pkg/imports/crds/enterprise/v1.crd.projectcalico.org/embed.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package crd serves the generated crd.projectcalico.org CRDs to the components
+// that install them, so nothing has to keep a copy of its own.
+package crd
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed *.yaml
+var crds embed.FS
+
+// FS returns the CRD YAML generated into this directory.
+func FS() fs.FS {
+	return crds
+}
diff --git a/pkg/imports/crds/enterprise/v3.projectcalico.org/embed.go b/pkg/imports/crds/enterprise/v3.projectcalico.org/embed.go
new file mode 100644
index 0000000000..c8057fcb43
--- /dev/null
+++ b/pkg/imports/crds/enterprise/v3.projectcalico.org/embed.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Tigera, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package crd serves the generated projectcalico.org v3 CRDs to the components
+// that install them, so nothing has to keep a copy of its own.
+package crd
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed *.yaml
+var crds embed.FS
+
+// FS returns the CRD YAML generated into this directory.
+func FS() fs.FS {
+	return crds
+}