diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml
index 62a74abd2e869..f17d802a3ad1b 100644
--- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml
+++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml
@@ -7,6 +7,10 @@ base_images:
     name: "4.19"
     namespace: origin
     tag: operator-sdk
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -102,6 +106,558 @@ tests:
         requests:
           cpu: 100m
     workflow: optional-operators-ci-operator-sdk-aws
+- always_run: false
+  as: tls-scanner
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: zero-trust-workload-identity-manager-bundle
+    env:
+      OO_INSTALL_MODE: AllNamespaces
+      OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager
+      OO_SECURITY_CONTEXT: restricted
+      SCAN_NAMESPACE: zero-trust-workload-identity-manager
+      SCANNER_CPU: "1"
+      SCANNER_MEMORY: 1Gi
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - as: deploy-operand
+      cli: latest
+      commands: |-
+        set -o errexit
+        set -o nounset
+        set -o pipefail
+
+        NS=zero-trust-workload-identity-manager
+
+        echo "Waiting for operator Deployment..."
+        oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m
+
+        echo "Waiting for managed CRDs..."
+        for crd in \
+          zerotrustworkloadidentitymanagers.operator.openshift.io \
+          spireservers.operator.openshift.io \
+          spireagents.operator.openshift.io \
+          spiffecsidrivers.operator.openshift.io \
+          spireoidcdiscoveryproviders.operator.openshift.io; do
+          oc wait --for=condition=Established "crd/${crd}" --timeout=5m
+        done
+
+        # Mirror the manual install flow: derive cluster-specific values, then apply
+        # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers
+        # operator and operand communication endpoints in ${NS}.
+        # Disable tracing while handling cluster-derived hostnames/issuer URLs.
+        [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false
+        set +x
+        APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')"
+        JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}"
+        CLUSTER_NAME="cluster1"
+        BUNDLE_CONFIGMAP="spire-bundle"
+
+        echo "Applying ZTWIM and SPIRE operand CRs..."
+        cat <<EOF | oc apply -f - >/dev/null
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: ZeroTrustWorkloadIdentityManager
+        metadata:
+          name: cluster
+        spec:
+          trustDomain: ${APP_DOMAIN}
+          clusterName: ${CLUSTER_NAME}
+          bundleConfigMap: ${BUNDLE_CONFIGMAP}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireServer
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          caValidity: 24h
+          defaultX509Validity: 1h
+          defaultJWTValidity: 5m
+          caSubject:
+            commonName: ${APP_DOMAIN}
+            country: "US"
+            organization: "RH"
+          persistence:
+            size: "1Gi"
+            accessMode: ReadWriteOncePod
+          datastore:
+            databaseType: sqlite3
+            connectionString: "/run/spire/data/datastore.sqlite3"
+            maxOpenConns: 100
+            maxIdleConns: 2
+            connMaxLifetime: 3600
+            disableMigration: "false"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireAgent
+        metadata:
+          name: cluster
+        spec:
+          nodeAttestor:
+            k8sPSATEnabled: "true"
+          workloadAttestors:
+            k8sEnabled: "true"
+            workloadAttestorsVerification:
+              type: "auto"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpiffeCSIDriver
+        metadata:
+          name: cluster
+        spec: {}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireOIDCDiscoveryProvider
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          managedRoute: "true"
+        EOF
+        $WAS_TRACING && set -x
+
+        echo "Waiting for SPIRE Server StatefulSet..."
+        oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m
+        oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIRE Agent DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m
+        oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIFFE CSI Driver DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m
+        oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m
+
+        echo "Waiting for OIDC Discovery Provider Deployment..."
+        oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+        oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+
+        echo "Operand pod status in ${NS} before TLS scan:"
+        oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+      timeout: 45m0s
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: optional-operators-ci-operator-sdk-aws
+- as: tls-scanner-periodic
+  cron: 0 6 * * 1
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: zero-trust-workload-identity-manager-bundle
+    env:
+      OO_INSTALL_MODE: AllNamespaces
+      OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager
+      OO_SECURITY_CONTEXT: restricted
+      SCAN_NAMESPACE: zero-trust-workload-identity-manager
+      SCANNER_CPU: "1"
+      SCANNER_MEMORY: 1Gi
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - as: deploy-operand
+      cli: latest
+      commands: |-
+        set -o errexit
+        set -o nounset
+        set -o pipefail
+
+        NS=zero-trust-workload-identity-manager
+
+        echo "Waiting for operator Deployment..."
+        oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m
+
+        echo "Waiting for managed CRDs..."
+        for crd in \
+          zerotrustworkloadidentitymanagers.operator.openshift.io \
+          spireservers.operator.openshift.io \
+          spireagents.operator.openshift.io \
+          spiffecsidrivers.operator.openshift.io \
+          spireoidcdiscoveryproviders.operator.openshift.io; do
+          oc wait --for=condition=Established "crd/${crd}" --timeout=5m
+        done
+
+        # Mirror the manual install flow: derive cluster-specific values, then apply
+        # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers
+        # operator and operand communication endpoints in ${NS}.
+        # Disable tracing while handling cluster-derived hostnames/issuer URLs.
+        [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false
+        set +x
+        APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')"
+        JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}"
+        CLUSTER_NAME="cluster1"
+        BUNDLE_CONFIGMAP="spire-bundle"
+
+        echo "Applying ZTWIM and SPIRE operand CRs..."
+        cat <<EOF | oc apply -f - >/dev/null
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: ZeroTrustWorkloadIdentityManager
+        metadata:
+          name: cluster
+        spec:
+          trustDomain: ${APP_DOMAIN}
+          clusterName: ${CLUSTER_NAME}
+          bundleConfigMap: ${BUNDLE_CONFIGMAP}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireServer
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          caValidity: 24h
+          defaultX509Validity: 1h
+          defaultJWTValidity: 5m
+          caSubject:
+            commonName: ${APP_DOMAIN}
+            country: "US"
+            organization: "RH"
+          persistence:
+            size: "1Gi"
+            accessMode: ReadWriteOncePod
+          datastore:
+            databaseType: sqlite3
+            connectionString: "/run/spire/data/datastore.sqlite3"
+            maxOpenConns: 100
+            maxIdleConns: 2
+            connMaxLifetime: 3600
+            disableMigration: "false"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireAgent
+        metadata:
+          name: cluster
+        spec:
+          nodeAttestor:
+            k8sPSATEnabled: "true"
+          workloadAttestors:
+            k8sEnabled: "true"
+            workloadAttestorsVerification:
+              type: "auto"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpiffeCSIDriver
+        metadata:
+          name: cluster
+        spec: {}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireOIDCDiscoveryProvider
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          managedRoute: "true"
+        EOF
+        $WAS_TRACING && set -x
+
+        echo "Waiting for SPIRE Server StatefulSet..."
+        oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m
+        oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIRE Agent DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m
+        oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIFFE CSI Driver DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m
+        oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m
+
+        echo "Waiting for OIDC Discovery Provider Deployment..."
+        oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+        oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+
+        echo "Operand pod status in ${NS} before TLS scan:"
+        oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+      timeout: 45m0s
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: optional-operators-ci-operator-sdk-aws
+- always_run: false
+  as: tls-pqc-readiness
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: zero-trust-workload-identity-manager-bundle
+    env:
+      OO_INSTALL_MODE: AllNamespaces
+      OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager
+      OO_SECURITY_CONTEXT: restricted
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: zero-trust-workload-identity-manager
+      SCANNER_CPU: "1"
+      SCANNER_MEMORY: 1Gi
+    test:
+    - as: deploy-operand
+      cli: latest
+      commands: |-
+        set -o errexit
+        set -o nounset
+        set -o pipefail
+
+        NS=zero-trust-workload-identity-manager
+
+        echo "Waiting for operator Deployment..."
+        oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m
+
+        echo "Waiting for managed CRDs..."
+        for crd in \
+          zerotrustworkloadidentitymanagers.operator.openshift.io \
+          spireservers.operator.openshift.io \
+          spireagents.operator.openshift.io \
+          spiffecsidrivers.operator.openshift.io \
+          spireoidcdiscoveryproviders.operator.openshift.io; do
+          oc wait --for=condition=Established "crd/${crd}" --timeout=5m
+        done
+
+        # Mirror the manual install flow: derive cluster-specific values, then apply
+        # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers
+        # operator and operand communication endpoints in ${NS}.
+        # Disable tracing while handling cluster-derived hostnames/issuer URLs.
+        [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false
+        set +x
+        APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')"
+        JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}"
+        CLUSTER_NAME="cluster1"
+        BUNDLE_CONFIGMAP="spire-bundle"
+
+        echo "Applying ZTWIM and SPIRE operand CRs..."
+        cat <<EOF | oc apply -f - >/dev/null
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: ZeroTrustWorkloadIdentityManager
+        metadata:
+          name: cluster
+        spec:
+          trustDomain: ${APP_DOMAIN}
+          clusterName: ${CLUSTER_NAME}
+          bundleConfigMap: ${BUNDLE_CONFIGMAP}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireServer
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          caValidity: 24h
+          defaultX509Validity: 1h
+          defaultJWTValidity: 5m
+          caSubject:
+            commonName: ${APP_DOMAIN}
+            country: "US"
+            organization: "RH"
+          persistence:
+            size: "1Gi"
+            accessMode: ReadWriteOncePod
+          datastore:
+            databaseType: sqlite3
+            connectionString: "/run/spire/data/datastore.sqlite3"
+            maxOpenConns: 100
+            maxIdleConns: 2
+            connMaxLifetime: 3600
+            disableMigration: "false"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireAgent
+        metadata:
+          name: cluster
+        spec:
+          nodeAttestor:
+            k8sPSATEnabled: "true"
+          workloadAttestors:
+            k8sEnabled: "true"
+            workloadAttestorsVerification:
+              type: "auto"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpiffeCSIDriver
+        metadata:
+          name: cluster
+        spec: {}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireOIDCDiscoveryProvider
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          managedRoute: "true"
+        EOF
+        $WAS_TRACING && set -x
+
+        echo "Waiting for SPIRE Server StatefulSet..."
+        oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m
+        oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIRE Agent DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m
+        oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIFFE CSI Driver DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m
+        oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m
+
+        echo "Waiting for OIDC Discovery Provider Deployment..."
+        oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+        oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+
+        echo "Operand pod status in ${NS} before TLS scan:"
+        oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+      timeout: 45m0s
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: optional-operators-ci-operator-sdk-aws
+- as: tls-pqc-readiness-periodic
+  cron: 0 6 * * 1
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: zero-trust-workload-identity-manager-bundle
+    env:
+      OO_INSTALL_MODE: AllNamespaces
+      OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager
+      OO_SECURITY_CONTEXT: restricted
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: zero-trust-workload-identity-manager
+      SCANNER_CPU: "1"
+      SCANNER_MEMORY: 1Gi
+    test:
+    - as: deploy-operand
+      cli: latest
+      commands: |-
+        set -o errexit
+        set -o nounset
+        set -o pipefail
+
+        NS=zero-trust-workload-identity-manager
+
+        echo "Waiting for operator Deployment..."
+        oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m
+
+        echo "Waiting for managed CRDs..."
+        for crd in \
+          zerotrustworkloadidentitymanagers.operator.openshift.io \
+          spireservers.operator.openshift.io \
+          spireagents.operator.openshift.io \
+          spiffecsidrivers.operator.openshift.io \
+          spireoidcdiscoveryproviders.operator.openshift.io; do
+          oc wait --for=condition=Established "crd/${crd}" --timeout=5m
+        done
+
+        # Mirror the manual install flow: derive cluster-specific values, then apply
+        # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers
+        # operator and operand communication endpoints in ${NS}.
+        # Disable tracing while handling cluster-derived hostnames/issuer URLs.
+        [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false
+        set +x
+        APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')"
+        JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}"
+        CLUSTER_NAME="cluster1"
+        BUNDLE_CONFIGMAP="spire-bundle"
+
+        echo "Applying ZTWIM and SPIRE operand CRs..."
+        cat <<EOF | oc apply -f - >/dev/null
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: ZeroTrustWorkloadIdentityManager
+        metadata:
+          name: cluster
+        spec:
+          trustDomain: ${APP_DOMAIN}
+          clusterName: ${CLUSTER_NAME}
+          bundleConfigMap: ${BUNDLE_CONFIGMAP}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireServer
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          caValidity: 24h
+          defaultX509Validity: 1h
+          defaultJWTValidity: 5m
+          caSubject:
+            commonName: ${APP_DOMAIN}
+            country: "US"
+            organization: "RH"
+          persistence:
+            size: "1Gi"
+            accessMode: ReadWriteOncePod
+          datastore:
+            databaseType: sqlite3
+            connectionString: "/run/spire/data/datastore.sqlite3"
+            maxOpenConns: 100
+            maxIdleConns: 2
+            connMaxLifetime: 3600
+            disableMigration: "false"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireAgent
+        metadata:
+          name: cluster
+        spec:
+          nodeAttestor:
+            k8sPSATEnabled: "true"
+          workloadAttestors:
+            k8sEnabled: "true"
+            workloadAttestorsVerification:
+              type: "auto"
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpiffeCSIDriver
+        metadata:
+          name: cluster
+        spec: {}
+        ---
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: SpireOIDCDiscoveryProvider
+        metadata:
+          name: cluster
+        spec:
+          jwtIssuer: ${JWT_ISSUER}
+          managedRoute: "true"
+        EOF
+        $WAS_TRACING && set -x
+
+        echo "Waiting for SPIRE Server StatefulSet..."
+        oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m
+        oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIRE Agent DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m
+        oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m
+
+        echo "Waiting for SPIFFE CSI Driver DaemonSet..."
+        oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m
+        oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m
+
+        echo "Waiting for OIDC Discovery Provider Deployment..."
+        oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+        oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m
+
+        echo "Operand pod status in ${NS} before TLS scan:"
+        oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+      timeout: 45m0s
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: optional-operators-ci-operator-sdk-aws
 - always_run: false
   as: e2e-operator-rhcos10-fips
   optional: true
diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml
new file mode 100644
index 0000000000000..fe09db65631f9
--- /dev/null
+++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml
@@ -0,0 +1,175 @@
+periodics:
+- agent: kubernetes
+  cluster: build05
+  cron: 0 6 * * 1
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.coverage
+  extra_refs:
+  - base_ref: main
+    org: openshift
+    repo: zero-trust-workload-identity-manager
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.coverage
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness-periodic
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=tls-pqc-readiness-periodic
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
+- agent: kubernetes
+  cluster: build05
+  cron: 0 6 * * 1
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.coverage
+  extra_refs:
+  - base_ref: main
+    org: openshift
+    repo: zero-trust-workload-identity-manager
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile
+    - Dockerfile.coverage
+  labels:
+    ci-operator.openshift.io/cloud: aws
+    ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner-periodic
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=tls-scanner-periodic
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml
index 594e903419544..69e6957f6a531 100644
--- a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml
@@ -555,6 +555,178 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )(operator-e2e-coverage|remaining-required),?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build06
+    context: ci/prow/tls-pqc-readiness
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - Dockerfile
+      - Dockerfile.coverage
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness
+    optional: true
+    rerun_command: /test tls-pqc-readiness
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=tls-pqc-readiness
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build06
+    context: ci/prow/tls-scanner
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - Dockerfile
+      - Dockerfile.coverage
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner
+    optional: true
+    rerun_command: /test tls-scanner
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=tls-scanner
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )tls-scanner,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches: