diff --git a/components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml b/components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml
new file mode 100644
index 000000000..f4beba4a2
--- /dev/null
+++ b/components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ambient-control-plane
+  namespace: ambient-code--runtime-int
+  labels:
+    app: ambient-control-plane
+spec:
+  selector:
+    app: ambient-control-plane
+  ports:
+    - name: token
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
diff --git a/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml b/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml
index 168d1379b..283de4e42 100644
--- a/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml
+++ b/components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml
@@ -76,6 +76,12 @@ spec:
               value: "ambient-vertex"
             - name: VERTEX_SECRET_NAMESPACE
               value: "ambient-code--runtime-int"
+            - name: CP_RUNTIME_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: CP_TOKEN_URL
+              value: "http://ambient-control-plane.ambient-code--ambient-s0.svc:8080/token"
           volumeMounts:
             - name: project-kube-token
               mountPath: /var/run/secrets/project-kube
diff --git a/components/manifests/overlays/mpp-openshift/kustomization.yaml b/components/manifests/overlays/mpp-openshift/kustomization.yaml
index 05573cb12..5f38a1c27 100644
--- a/components/manifests/overlays/mpp-openshift/kustomization.yaml
+++ b/components/manifests/overlays/mpp-openshift/kustomization.yaml
@@ -8,6 +8,7 @@ resources:
 - ambient-api-server-db.yaml
 - ambient-api-server.yaml
 - ambient-control-plane.yaml
+- ambient-control-plane-svc.yaml
 - ambient-api-server-route.yaml
 - ambient-control-plane-sa.yaml
 - tenant-rbac/