diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml
index 631d102946fcd..8f9fe32f79f17 100644
--- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml
+++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml
@@ -3,6 +3,10 @@ base_images:
     name: cli-operator-sdk
     namespace: ocp
     tag: v1.31.0
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
   ubi-min9:
     name: ubi-minimal
     namespace: ocp
@@ -95,6 +99,93 @@ tests:
           cpu: 100m
           memory: 200Mi
     workflow: optional-operators-ci-operator-sdk-aws
+- always_run: false
+  as: install-bundle-tls-scan
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: operator-bundle
+    env:
+      COMPUTE_NODE_TYPE: m5.2xlarge
+      OO_INSTALL_NAMESPACE: oran-o2ims
+      SCAN_NAMESPACE: oran-o2ims
+      SCANNER_NAMESPACE: oran-o2ims
+    test:
+    - ref: optional-operators-operator-sdk
+    - as: wait-for-server-pods
+      cli: latest
+      commands: |
+        NAMESPACE=oran-o2ims
+        echo "Waiting for Inventory CR to be auto-created..."
+        for i in $(seq 1 60); do
+          if oc get inventory default -n "$NAMESPACE" &>/dev/null; then
+            echo "Inventory CR 'default' found."
+            break
+          fi
+          echo "  attempt $i/60..."
+          sleep 5
+        done
+
+        echo ""
+        echo "Discovering services with TLS serving certs..."
+        TLS_SERVICES=$(oc get services -n "$NAMESPACE" \
+          -o jsonpath='{range .items[?(@.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name)]}{.metadata.name}{"\n"}{end}')
+
+        echo "TLS services found:"
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          echo "  $svc -> secret: $SECRET"
+        done
+
+        echo ""
+        echo "Waiting for TLS service pods to be ready..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SELECTOR=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o go-template='{{range $k,$v := .spec.selector}}{{$k}}={{$v}},{{end}}' | sed 's/,$//')
+          if [ -z "$SELECTOR" ]; then
+            echo "  SKIP: $svc has no selector"
+            continue
+          fi
+          echo "  $svc (selector: $SELECTOR)..."
+          if ! oc wait pods -l "$SELECTOR" -n "$NAMESPACE" \
+            --for=condition=Ready --timeout=5m; then
+            echo "  WARNING: pods for $svc did not become ready within 5m"
+            echo "  Pod status:"
+            oc get pods -l "$SELECTOR" -n "$NAMESPACE" --no-headers | sed 's/^/    /'
+            echo "  Recent events:"
+            oc get events -n "$NAMESPACE" --field-selector reason!=Pulling,reason!=Pulled \
+              --sort-by='.lastTimestamp' 2>/dev/null | grep "$svc" | tail -5 | sed 's/^/    /' \
+              || echo "    (no events found)"
+          fi
+        done
+
+        echo ""
+        echo "Verifying TLS secrets from service-ca..."
+        echo "$TLS_SERVICES" | while read -r svc; do
+          [ -z "$svc" ] && continue
+          SECRET=$(oc get service "$svc" -n "$NAMESPACE" \
+            -o jsonpath='{.metadata.annotations.service\.beta\.openshift\.io/serving-cert-secret-name}')
+          if oc get secret "$SECRET" -n "$NAMESPACE" &>/dev/null; then
+            echo "  $SECRET exists"
+          else
+            echo "  WARNING: $SECRET not found"
+          fi
+        done
+
+        echo ""
+        echo "Final pod status in $NAMESPACE:"
+        oc get pods -n "$NAMESPACE"
+      from: cli
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    - ref: tls-scanner-run
+    workflow: ipi-aws
 - always_run: false
   as: markdownlint
   commands: |
diff --git a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml
index 0202a1a2dea93..757a21da5fc30 100644
--- a/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yaml
@@ -187,6 +187,93 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build09
+    context: ci/prow/install-bundle-tls-scan
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - Dockerfile
+      - Dockerfile.must-gather
+      - bundle.Dockerfile
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-kni-oran-o2ims-main-install-bundle-tls-scan
+    optional: true
+    rerun_command: /test install-bundle-tls-scan
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=install-bundle-tls-scan
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )install-bundle-tls-scan,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:
diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
index 3d7a3131a92fe..620eef0b0de8f 100644
--- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
+++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
@@ -6,8 +6,14 @@ set -o pipefail
 run_tls_scan() {
 
   # TLS Scanner - scans TLS configurations of all pods in the cluster
-  local NAMESPACE="tls-scanner"
+  local NAMESPACE="${SCANNER_NAMESPACE:-tls-scanner}"
   local OWNS_NAMESPACE=true
+  # When SCANNER_NAMESPACE is explicitly set, deploy into an existing namespace
+  # (do not create/delete it). Check the variable itself, not the resolved value,
+  # so that SCANNER_NAMESPACE=tls-scanner is also treated as externally owned.
+  if [[ -n "${SCANNER_NAMESPACE:-}" ]]; then
+      OWNS_NAMESPACE=false
+  fi
   local SCANNER_IMAGE="${PULL_SPEC_TLS_SCANNER_TOOL}"
   local ARTIFACT_DIR="${ARTIFACT_DIR:-/tmp/artifacts}"
 
diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
index d7d22f177e0aa..e64b6a450359c 100644
--- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
+++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
@@ -7,6 +7,12 @@ ref:
   - name: SCAN_NAMESPACE
     default: ""
     documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces."
+  - name: SCANNER_NAMESPACE
+    default: ""
+    documentation: |-
+      Namespace where the scanner pod is deployed. When set, the scanner runs
+      in this existing namespace instead of creating a dedicated 'tls-scanner'
+      namespace.
   - name: PQC_CHECK
     default: "false"
     documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)."