diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 4c1904a4..112c3493 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -26,7 +26,7 @@ jobs:
           filters: |
             codechange:
               - ".github/workflows/build-test.yaml"
-              - "Dockerfile"
+              - "Dockerfile.openshift"
               - "go.mod"
               - "go.sum"
               - "cmd/**"
@@ -66,7 +66,8 @@ jobs:
       - uses: "authzed/actions/docker-build@main"
         with:
           push: false
-          tags: "authzed/spicedb-operator:ci"
+          file: Dockerfile.openshift
+          tags: "spicedb-operator:ci"
           buildx: false
           qemu: false
 
diff --git a/Dockerfile.openshift b/Dockerfile.openshift
new file mode 100644
index 00000000..40c46d7f
--- /dev/null
+++ b/Dockerfile.openshift
@@ -0,0 +1,21 @@
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9-1161 AS builder
+ARG TARGETARCH
+USER root
+RUN microdnf install -y tar gzip make which
+# install platform specific go version
+RUN curl -O -J  https://dl.google.com/go/go1.22.0.linux-${TARGETARCH}.tar.gz
+RUN tar -C /usr/local -xzf go1.22.0.linux-${TARGETARCH}.tar.gz
+RUN ln -s /usr/local/go/bin/go /usr/local/bin/go
+
+WORKDIR /go/src/app
+ENV CGO_ENABLED=0
+
+COPY go.mod go.sum ./
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod go build ./cmd/...
+
+FROM cgr.dev/chainguard/static:latest
+
+COPY --from=builder /go/src/app/validated-update-graph.yaml /opt/operator/config.yaml
+COPY --from=builder /go/src/app/spicedb-operator /usr/local/bin/spicedb-operator
+ENTRYPOINT ["spicedb-operator"]
diff --git a/build_deploy.sh b/build_deploy.sh
new file mode 100755
index 00000000..d8f6bfbc
--- /dev/null
+++ b/build_deploy.sh
@@ -0,0 +1,22 @@
+set -exv
+
+IMAGE="quay.io/cloudservices/spicedb-operator"
+IMAGE_TAG=$(git rev-parse --short=7 HEAD)
+GIT_COMMIT=$(git rev-parse --short HEAD)
+
+if [[ -z "$QUAY_USER" || -z "$QUAY_TOKEN" ]]; then
+    echo "QUAY_USER and QUAY_TOKEN must be set"
+    exit 1
+fi
+
+if [[ -z "$RH_REGISTRY_USER" || -z "$RH_REGISTRY_TOKEN" ]]; then
+    echo "RH_REGISTRY_USER and RH_REGISTRY_TOKEN  must be set"
+    exit 1
+fi
+
+DOCKER_CONF="$PWD/.docker"
+mkdir -p "$DOCKER_CONF"
+docker --config="$DOCKER_CONF" login -u="$QUAY_USER" -p="$QUAY_TOKEN" quay.io
+docker --config="$DOCKER_CONF" login -u="$RH_REGISTRY_USER" -p="$RH_REGISTRY_TOKEN" registry.redhat.io
+docker --config="$DOCKER_CONF" build --build-arg GIT_COMMIT=$GIT_COMMIT --no-cache -t "${IMAGE}:${IMAGE_TAG}" .
+docker --config="$DOCKER_CONF" push "${IMAGE}:${IMAGE_TAG}"
diff --git a/config/operator_openshift.yaml b/config/operator_openshift.yaml
new file mode 100644
index 00000000..dfb36cf1
--- /dev/null
+++ b/config/operator_openshift.yaml
@@ -0,0 +1,106 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: spicedb-operator
+  name: spicedb-operator
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: spicedb-operator
+    app.kubernetes.io/instance: spicedb-operator
+  name: spicedb-operator
+  namespace: spicedb-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: spicedb-operator
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: spicedb-operator
+        app.kubernetes.io/instance: spicedb-operator
+    spec:
+      containers:
+        - args:
+          - run
+          - -v=4
+          - --crd=false
+          - --config
+          - /opt/operator/config.yaml
+          image: ghcr.io/authzed/spicedb-operator:latest
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 15
+          name: spicedb-operator
+          ports:
+            - containerPort: 8080
+              name: prometheus
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              scheme: HTTP
+            periodSeconds: 1
+            successThreshold: 1
+            timeoutSeconds: 15
+          resources:
+            limits:
+              cpu: "250m"
+              memory: "128Mi"
+            requests:
+              cpu: "20m"
+              memory: "32Mi"
+          securityContext:
+            runAsUser: 1001330000
+            runAsGroup: 1001330000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            seccompProfile:
+              type: RuntimeDefault
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          terminationMessagePolicy: FallbackToLogsOnError
+      securityContext:
+        runAsUser: 1001330000
+        runAsGroup: 1001330000
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: spicedb-operator
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: spicedb-operator
+  namespace: spicedb-operator
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: spicedb-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: spicedb-operator
+subjects:
+  - kind: ServiceAccount
+    name: spicedb-operator
+    namespace: spicedb-operator
diff --git a/deploy/deploy.yml b/deploy/deploy.yml
new file mode 100644
index 00000000..9d6ab42e
--- /dev/null
+++ b/deploy/deploy.yml
@@ -0,0 +1,578 @@
+apiVersion: v1
+kind: Template
+metadata:
+  name: spicedb-operator
+objects:
+- apiVersion: v1
+  kind: Namespace
+  metadata:
+    labels:
+      kubernetes.io/metadata.name: spicedb-operator
+    name: spicedb-operator
+- apiVersion: apiextensions.k8s.io/v1
+  kind: CustomResourceDefinition
+  metadata:
+    annotations:
+      controller-gen.kubebuilder.io/version: v0.12.1
+    name: spicedbclusters.authzed.com
+  spec:
+    group: authzed.com
+    names:
+      categories:
+      - authzed
+      kind: SpiceDBCluster
+      listKind: SpiceDBClusterList
+      plural: spicedbclusters
+      shortNames:
+      - spicedbs
+      singular: spicedbcluster
+    scope: Namespaced
+    versions:
+    - additionalPrinterColumns:
+      - jsonPath: .metadata.creationTimestamp
+        name: Age
+        type: date
+      - jsonPath: .spec.channel
+        name: Channel
+        type: string
+      - jsonPath: .spec.version
+        name: Desired
+        type: string
+      - jsonPath: .status.version.name
+        name: Current
+        type: string
+      - jsonPath: .status.conditions[?(@.type=='ConfigurationWarning')].status
+        name: Warnings
+        type: string
+      - jsonPath: .status.conditions[?(@.type=='Migrating')].status
+        name: Migrating
+        type: string
+      - jsonPath: .status.conditions[?(@.type=='RollingDeployment')].status
+        name: Updating
+        type: string
+      - jsonPath: .status.conditions[?(@.type=='ConditionValidatingFailed')].status
+        name: Invalid
+        type: string
+      - jsonPath: .status.conditions[?(@.type=='Paused')].status
+        name: Paused
+        type: string
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: SpiceDBCluster defines all options for a full SpiceDB cluster
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+                of an object. Servers should convert recognized schemas to the latest
+                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+                object represents. Servers may infer this from the endpoint the client
+                submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ClusterSpec holds the desired state of the cluster.
+              properties:
+                channel:
+                  description: Channel is a defined series of updates that operator
+                    should follow. The operator is configured with a datasource that
+                    configures available channels and update paths. If `version` is
+                    not specified, then the operator will keep SpiceDB up-to-date with
+                    the current head of the channel. If `version` is specified, then
+                    the operator will write available updates in the status.
+                  type: string
+                config:
+                  description: Config values to be passed to the cluster
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                patches:
+                  description: Patches is a list of patches to apply to generated resources.
+                    If multiple patches apply to the same object and field, later patches
+                    in the list take precedence over earlier ones.
+                  items:
+                    description: Patch represents a single change to apply to generated
+                      manifests
+                    properties:
+                      kind:
+                        description: Kind targets an object by its kubernetes Kind name.
+                        type: string
+                      patch:
+                        description: Patch is an inlined representation of a structured
+                          merge patch (one that just specifies the structure and fields
+                          to be modified) or a an explicit JSON6902 patch operation.
+                        type: object
+                        x-kubernetes-preserve-unknown-fields: true
+                    required:
+                    - patch
+                    type: object
+                  type: array
+                secretName:
+                  description: SecretName points to a secret (in the same namespace)
+                    that holds secret config for the cluster like passwords, credentials,
+                    etc. If the secret is omitted, one will be generated
+                  type: string
+                version:
+                  description: Version is the name of the version of SpiceDB that will
+                    be run. The version is usually a simple version string like `v1.13.0`,
+                    but the operator is configured with a data source that tells it
+                    what versions are allowed, and they may have other names. If omitted,
+                    the newest version in the head of the channel will be used. Note
+                    that the `config.image` field will take precedence over version/channel,
+                    if it is specified
+                  type: string
+              type: object
+            status:
+              description: ClusterStatus communicates the observed state of the cluster.
+              properties:
+                availableVersions:
+                  description: AvailableVersions is a list of versions that the currently
+                    running version can be updated to. Only applies if using an update
+                    channel.
+                  items:
+                    properties:
+                      attributes:
+                        description: Attributes is an optional set of descriptors for
+                          the update, which carry additional information like whether
+                          there will be a migration if this version is selected.
+                        items:
+                          type: string
+                        type: array
+                      channel:
+                        description: Channel is the name of the channel this version
+                          is in
+                        type: string
+                      description:
+                        description: Description a human-readable description of the
+                          update.
+                        type: string
+                      name:
+                        description: Name is the identifier for this version
+                        type: string
+                    required:
+                    - channel
+                    - name
+                    type: object
+                  type: array
+                conditions:
+                  description: Conditions for the current state of the Stack.
+                  items:
+                    description: "Condition contains details for one aspect of the current
+                      state of this API Resource. --- This struct is intended for direct
+                      use as an array at the field path .status.conditions.  For example,
+                      \n type FooStatus struct{ // Represents the observations of a
+                      foo's current state. // Known .status.conditions.type are: \"Available\",
+                      \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                      // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                      `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                      protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                    properties:
+                      lastTransitionTime:
+                        description: lastTransitionTime is the last time the condition
+                          transitioned from one status to another. This should be when
+                          the underlying condition changed.  If that is not known, then
+                          using the time when the API field changed is acceptable.
+                        format: date-time
+                        type: string
+                      message:
+                        description: message is a human readable message indicating
+                          details about the transition. This may be an empty string.
+                        maxLength: 32768
+                        type: string
+                      observedGeneration:
+                        description: observedGeneration represents the .metadata.generation
+                          that the condition was set based upon. For instance, if .metadata.generation
+                          is currently 12, but the .status.conditions[x].observedGeneration
+                          is 9, the condition is out of date with respect to the current
+                          state of the instance.
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      reason:
+                        description: reason contains a programmatic identifier indicating
+                          the reason for the condition's last transition. Producers
+                          of specific condition types may define expected values and
+                          meanings for this field, and whether the values are considered
+                          a guaranteed API. The value should be a CamelCase string.
+                          This field may not be empty.
+                        maxLength: 1024
+                        minLength: 1
+                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                        type: string
+                      status:
+                        description: status of the condition, one of True, False, Unknown.
+                        enum:
+                        - "True"
+                        - "False"
+                        - Unknown
+                        type: string
+                      type:
+                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                          --- Many .condition.type values are consistent across resources
+                          like Available, but because arbitrary conditions can be useful
+                          (see .node.status.conditions), the ability to deconflict is
+                          important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                        maxLength: 316
+                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                        type: string
+                    required:
+                    - lastTransitionTime
+                    - message
+                    - reason
+                    - status
+                    - type
+                    type: object
+                  type: array
+                currentMigrationHash:
+                  description: CurrentMigrationHash is a hash of the currently running
+                    migration target and config. If this is equal to TargetMigrationHash
+                    (and there are no conditions) then the datastore is fully migrated.
+                  type: string
+                image:
+                  description: Image is the image that is or will be used for this cluster
+                  type: string
+                migration:
+                  description: Migration is the name of the last migration applied
+                  type: string
+                observedGeneration:
+                  description: ObservedGeneration represents the .metadata.generation
+                    that has been seen by the controller.
+                  format: int64
+                  minimum: 0
+                  type: integer
+                phase:
+                  description: Phase is the currently running phase (used for phased
+                    migrations)
+                  type: string
+                secretHash:
+                  description: SecretHash is a digest of the last applied secret
+                  type: string
+                targetMigrationHash:
+                  description: TargetMigrationHash is a hash of the desired migration
+                    target and config
+                  type: string
+                version:
+                  description: CurrentVersion is a description of the currently selected
+                    version from the channel, if an update channel is being used.
+                  properties:
+                    attributes:
+                      description: Attributes is an optional set of descriptors for
+                        the update, which carry additional information like whether
+                        there will be a migration if this version is selected.
+                      items:
+                        type: string
+                      type: array
+                    channel:
+                      description: Channel is the name of the channel this version is
+                        in
+                      type: string
+                    description:
+                      description: Description a human-readable description of the update.
+                      type: string
+                    name:
+                      description: Name is the identifier for this version
+                      type: string
+                  required:
+                  - channel
+                  - name
+                  type: object
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+- apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    name: spicedb-operator
+    namespace: spicedb-operator
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    name: spicedb-operator
+  rules:
+  - apiGroups:
+    - ""
+    resources:
+    - endpoints
+    verbs:
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - events
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - jobs
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - pods
+    verbs:
+    - delete
+    - get
+    - list
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - secrets
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - serviceaccounts
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - services
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - authzed.com
+    resources:
+    - spicedbclusters
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - authzed.com
+    resources:
+    - spicedbclusters/status
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - batch
+    resources:
+    - jobs
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - rbac.authorization.k8s.io
+    resources:
+    - rolebindings
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - rbac.authorization.k8s.io
+    resources:
+    - roles
+    verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    labels:
+      rbac.authorization.k8s.io/aggregate-to-admin: "true"
+      rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    name: spicedb-operator-edit
+  rules:
+  - apiGroups:
+    - authzed.com
+    resources:
+    - spicedbclusters
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - patch
+    - update
+  - apiGroups:
+    - authzed.com
+    resources:
+    - spicedbclusters/status
+    verbs:
+    - update
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    labels:
+      rbac.authorization.k8s.io/aggregate-to-admin: "true"
+      rbac.authorization.k8s.io/aggregate-to-edit: "true"
+      rbac.authorization.k8s.io/aggregate-to-view: "true"
+    name: spicedb-operator-view
+  rules:
+  - apiGroups:
+    - authzed.com
+    resources:
+    - spicedbclusters
+    verbs:
+    - get
+    - list
+    - watch
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRoleBinding
+  metadata:
+    name: spicedb-operator
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: spicedb-operator
+  subjects:
+  - kind: ServiceAccount
+    name: spicedb-operator
+    namespace: spicedb-operator
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    labels:
+      app: spicedb-operator
+      app.kubernetes.io/instance: spicedb-operator
+    name: spicedb-operator
+    namespace: spicedb-operator
+  spec:
+    replicas: 1
+    selector:
+      matchLabels:
+        app: spicedb-operator
+    strategy:
+      rollingUpdate:
+        maxSurge: 25%
+        maxUnavailable: 25%
+      type: RollingUpdate
+    template:
+      metadata:
+        labels:
+          app: spicedb-operator
+          app.kubernetes.io/instance: spicedb-operator
+      spec:
+        containers:
+        - args:
+          - run
+          - -v=4
+          - --crd=false
+          - --config
+          - /opt/operator/config.yaml
+          image: ghcr.io/authzed/spicedb-operator:v1.14.1
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 15
+          name: spicedb-operator
+          ports:
+          - containerPort: 8080
+            name: prometheus
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              scheme: HTTP
+            periodSeconds: 1
+            successThreshold: 1
+            timeoutSeconds: 15
+          resources:
+            limits:
+              cpu: 250m
+              memory: 128Mi
+            requests:
+              cpu: 20m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsGroup: 
+            runAsNonRoot: true
+            runAsUser: 
+            seccompProfile:
+              type: RuntimeDefault
+          terminationMessagePolicy: FallbackToLogsOnError
+        securityContext:
+          runAsGroup: 
+          runAsNonRoot: true
+          runAsUser: 
+          seccompProfile:
+            type: RuntimeDefault
+        serviceAccountName: spicedb-operator