diff --git a/config/install.yaml b/config/install.yaml
index ad90fb18..7e5be908 100644
--- a/config/install.yaml
+++ b/config/install.yaml
@@ -1799,6 +1799,26 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. Optional.
@@ -2632,6 +2652,26 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional.