diff --git a/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml b/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
index 3338f4460..b72a6385d 100644
--- a/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
+++ b/inventory/sample/group_vars/k8s_cluster/k8s-net-custom-cni.yml
@@ -9,10 +9,16 @@
 ## List of Kubernetes resource manifest files
 ## See tests/files/custom_cni/README.md for example
 # custom_cni_manifests: []
+#
+## Namespace passed to kubectl when applying manifests.
+## Set to an empty string for multi-namespace manifests where every namespaced
+## resource declares metadata.namespace.
+# custom_cni_namespace: "kube-system"
 
 ## OPTION 1 EXAMPLE - Cilium static manifests in Kubespray tree
 # custom_cni_manifests:
 #   - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+# custom_cni_namespace: ""
 
 ## OPTION 2 - Helm chart application
 ## This allows the CNI backend to be deployed to Kubespray cluster
diff --git a/roles/network_plugin/custom_cni/defaults/main.yml b/roles/network_plugin/custom_cni/defaults/main.yml
index 0eab14374..9bc25bd80 100644
--- a/roles/network_plugin/custom_cni/defaults/main.yml
+++ b/roles/network_plugin/custom_cni/defaults/main.yml
@@ -1,6 +1,7 @@
 ---
 
 custom_cni_manifests: []
+custom_cni_namespace: kube-system
 
 custom_cni_chart_namespace: kube-system
 custom_cni_chart_release_name: ""
diff --git a/roles/network_plugin/custom_cni/tasks/main.yml b/roles/network_plugin/custom_cni/tasks/main.yml
index a1397c828..64cf7b7d7 100644
--- a/roles/network_plugin/custom_cni/tasks/main.yml
+++ b/roles/network_plugin/custom_cni/tasks/main.yml
@@ -19,7 +19,7 @@
 
   - name: Custom CNI | Start Resources
     kube:
-      namespace: "kube-system"
+      namespace: "{{ custom_cni_namespace | default(omit, true) }}"
       kubectl: "{{ bin_dir }}/kubectl"
       filename: "{{ kube_config_dir }}/{{ item | basename | replace('.j2', '') }}"
       state: "latest"
diff --git a/tests/files/custom_cni/README.md b/tests/files/custom_cni/README.md
index dd3024061..1fc45dc7b 100644
--- a/tests/files/custom_cni/README.md
+++ b/tests/files/custom_cni/README.md
@@ -9,3 +9,17 @@ helm repo add cilium https://helm.cilium.io/
 helm repo update
 helm template cilium/cilium -n kube-system -f values.yaml > cilium.yaml
 ```
+
+The generated Cilium manifest contains resources in both the `kube-system` and
+`cilium-secrets` namespaces. Configure the static manifest example without a
+kubectl namespace argument:
+
+```yaml
+custom_cni_manifests:
+  - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+custom_cni_namespace: ""
+```
+
+When `custom_cni_namespace` is empty, every namespaced resource in the
+manifests should declare `metadata.namespace`. Otherwise, kubectl applies the
+resource to the current context's default namespace.
diff --git a/tests/files/debian11-custom-cni.yml b/tests/files/debian11-custom-cni.yml
index 726a65c45..5d8ea4545 100644
--- a/tests/files/debian11-custom-cni.yml
+++ b/tests/files/debian11-custom-cni.yml
@@ -7,6 +7,7 @@ kube_owner: root
 kube_network_plugin: custom_cni
 custom_cni_manifests:
   - "{{ playbook_dir }}/../tests/files/custom_cni/cilium.yaml"
+custom_cni_namespace: ""
 
 # Use static containerd binary for older distributions like Debian 11.
 containerd_static_binary: true