diff --git a/internal/controller/dash0_controller.go b/internal/controller/dash0_controller.go
index 181ed43e..b31cdce8 100644
--- a/internal/controller/dash0_controller.go
+++ b/internal/controller/dash0_controller.go
@@ -665,7 +665,7 @@ func (r *Dash0Reconciler) findAndUninstrumentCronJobs(
 	logger *logr.Logger,
 ) error {
 	matchingWorkloadsInNamespace, err :=
-		r.ClientSet.BatchV1().CronJobs(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter)
+		r.ClientSet.BatchV1().CronJobs(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelFilter)
 	if err != nil {
 		return fmt.Errorf("error when querying instrumented cron jobs: %w", err)
 	}
@@ -688,7 +688,7 @@ func (r *Dash0Reconciler) uninstrumentCronJob(
 
 func (r *Dash0Reconciler) findAndUninstrumentDaemonSets(ctx context.Context, namespace string, logger *logr.Logger) error {
 	matchingWorkloadsInNamespace, err :=
-		r.ClientSet.AppsV1().DaemonSets(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter)
+		r.ClientSet.AppsV1().DaemonSets(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelFilter)
 	if err != nil {
 		return fmt.Errorf("error when querying instrumented daemon sets: %w", err)
 	}
@@ -715,7 +715,7 @@ func (r *Dash0Reconciler) findAndUninstrumentDeployments(
 	logger *logr.Logger,
 ) error {
 	matchingWorkloadsInNamespace, err :=
-		r.ClientSet.AppsV1().Deployments(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter)
+		r.ClientSet.AppsV1().Deployments(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelFilter)
 	if err != nil {
 		return fmt.Errorf("error when querying instrumented deployments: %w", err)
 	}
@@ -741,7 +741,7 @@ func (r *Dash0Reconciler) findAndHandleJobOnUninstrumentation(
 	namespace string,
 	logger *logr.Logger,
 ) error {
-	matchingWorkloadsInNamespace, err := r.ClientSet.BatchV1().Jobs(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter)
+	matchingWorkloadsInNamespace, err := r.ClientSet.BatchV1().Jobs(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelFilter)
 	if err != nil {
 		return fmt.Errorf("error when querying instrumented jobs: %w", err)
 	}
@@ -787,15 +787,11 @@ func (r *Dash0Reconciler) handleJobOnUninstrumentation(ctx context.Context, job
 			// We only need remove the labels from that instrumentation attempt to clean up.
 			newWorkloadModifier(r.Versions, &logger).RemoveLabelsFromImmutableJob(&job)
 
-			// Apparently for jobs we do not need to set the "dash0.webhook.ignore.once" label, since changing there
+			// Apparently for jobs we do not need to set the "dash0.com/webhook-ignore-once" label, since changing their
 			// labels does not trigger a new admission request.
 			return r.Client.Update(ctx, &job)
-		} else if util.HasOptedOutOfInstrumenation(&job.ObjectMeta) {
-			// There is an opt-out marker for this job, so we have never attempted to instrument it and also do not
-			// need to revert anything or remove any labels.
-			return nil
 		} else {
-			// No dash0.instrumented label is present, do nothing.
+			// No dash0.com/instrumented label is present, do nothing.
 			return nil
 		}
 	}, &logger)
@@ -823,7 +819,7 @@ func (r *Dash0Reconciler) findAndUninstrumentReplicaSets(
 	logger *logr.Logger,
 ) error {
 	matchingWorkloadsInNamespace, err :=
-		r.ClientSet.AppsV1().ReplicaSets(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter)
+		r.ClientSet.AppsV1().ReplicaSets(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelFilter)
 	if err != nil {
 		return fmt.Errorf("error when querying instrumented replica sets: %w", err)
 	}
@@ -850,7 +846,7 @@ func (r *Dash0Reconciler) findAndUninstrumentStatefulSets(
 	logger *logr.Logger,
 ) error {
 	matchingWorkloadsInNamespace, err :=
-		r.ClientSet.AppsV1().StatefulSets(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter)
+		r.ClientSet.AppsV1().StatefulSets(namespace).List(ctx, util.WorkloadsWithDash0InstrumentedLabelFilter)
 	if err != nil {
 		return fmt.Errorf("error when querying instrumented stateful sets: %w", err)
 	}
diff --git a/internal/controller/dash0_controller_test.go b/internal/controller/dash0_controller_test.go
index 494ba53b..66a18b3e 100644
--- a/internal/controller/dash0_controller_test.go
+++ b/internal/controller/dash0_controller_test.go
@@ -396,7 +396,7 @@ var _ = Describe("The Dash0 controller", func() {
 			triggerReconcileRequest(ctx, reconciler, "Trigger first reconcile request")
 
 			name := UniqueName(JobNamePrefix)
-			By("Create a job with labels (dash0.instrumented=unsuccessful)")
+			By("Create a job with label dash0.com/instrumented=false")
 			job := CreateJobForWhichAnInstrumentationAttemptHasFailed(ctx, k8sClient, namespace, name)
 			createdObjects = append(createdObjects, job)
 
diff --git a/internal/util/labels.go b/internal/util/labels.go
index d9bd1c75..61daef90 100644
--- a/internal/util/labels.go
+++ b/internal/util/labels.go
@@ -10,35 +10,32 @@ import (
 )
 
 const (
-	instrumentedLabelKey = "dash0.instrumented"
+	instrumentedLabelKey = "dash0.com/instrumented"
 
-	// InstrumentedLabelValueSuccessful os written by the operator when then instrumentation attempt has been
+	// instrumentedLabelValueSuccessful os written by the operator when then instrumentation attempt has been
 	// successful.
-	instrumentedLabelValueSuccessful instrumentedState = "successful"
+	instrumentedLabelValueSuccessful instrumentedState = "true"
 
-	// InstrumentedLabelValueUnsuccessful is written by the operator when then instrumentation attempt has failed.
-	instrumentedLabelValueUnsuccessful instrumentedState = "unsuccessful"
+	// instrumentedLabelValueUnsuccessful is written by the operator when then instrumentation attempt has failed.
+	instrumentedLabelValueUnsuccessful instrumentedState = "false"
 
-	// InstrumentedLabelValueOptOut is never written by the operator, this can be set externally to opt-out of
-	// instrumentation for a particular workload
-	instrumentedLabelValueOptOut instrumentedState = "false"
-
-	// InstrumentedLabelValueUnknown should never occur in the wild, it is used as a fallback for inconsistent states
+	// instrumentedLabelValueUnknown should never occur in the wild, it is used as a fallback for inconsistent states
 	// or when the label is missing entirely.
 	instrumentedLabelValueUnknown instrumentedState = "unknown"
 
-	operatorVersionLabelKey           = "dash0.operator.version"
-	initContainerImageVersionLabelKey = "dash0.initcontainer.image.version"
-	instrumentedByLabelKey            = "dash0.instrumented.by"
-	webhookIgnoreOnceLabelKey         = "dash0.webhook.ignore.once"
+	optOutLabelKey                    = "dash0.com/opt-out"
+	operatorVersionLabelKey           = "dash0.com/operator-version"
+	initContainerImageVersionLabelKey = "dash0.com/init-container-image-version"
+	instrumentedByLabelKey            = "dash0.com/instrumented-by"
+	webhookIgnoreOnceLabelKey         = "dash0.com/webhook-ignore-once"
 )
 
 var (
 	WorkloadsWithoutDash0InstrumentedLabelFilter = metav1.ListOptions{
-		LabelSelector: fmt.Sprintf("!%s", instrumentedLabelKey),
+		LabelSelector: fmt.Sprintf("!%s,%s != true", instrumentedLabelKey, optOutLabelKey),
 	}
-	WorkloadsWithDash0InstrumentedLabelExlucdingOptOutFilter = metav1.ListOptions{
-		LabelSelector: fmt.Sprintf("%[1]s,%[1]s != false", instrumentedLabelKey),
+	WorkloadsWithDash0InstrumentedLabelFilter = metav1.ListOptions{
+		LabelSelector: fmt.Sprintf("%s,%s != true", instrumentedLabelKey, optOutLabelKey),
 	}
 )
 
@@ -71,9 +68,7 @@ func addLabel(meta *metav1.ObjectMeta, key string, value string) {
 }
 
 func RemoveInstrumentationLabels(meta *metav1.ObjectMeta) {
-	if meta.GetLabels()[instrumentedLabelKey] != "false" {
-		removeLabel(meta, instrumentedLabelKey)
-	}
+	removeLabel(meta, instrumentedLabelKey)
 	removeLabel(meta, operatorVersionLabelKey)
 	removeLabel(meta, initContainerImageVersionLabelKey)
 	removeLabel(meta, instrumentedByLabelKey)
@@ -91,10 +86,6 @@ func InstrumenationAttemptHasFailed(meta *metav1.ObjectMeta) bool {
 	return readInstrumentationState(meta) == instrumentedLabelValueUnsuccessful
 }
 
-func HasOptedOutOfInstrumenation(meta *metav1.ObjectMeta) bool {
-	return readInstrumentationState(meta) == instrumentedLabelValueOptOut
-}
-
 func readInstrumentationState(meta *metav1.ObjectMeta) instrumentedState {
 	if meta.Labels == nil {
 		return instrumentedLabelValueUnknown
@@ -104,20 +95,28 @@ func readInstrumentationState(meta *metav1.ObjectMeta) instrumentedState {
 		return instrumentedLabelValueSuccessful
 	case string(instrumentedLabelValueUnsuccessful):
 		return instrumentedLabelValueUnsuccessful
-	case string(instrumentedLabelValueOptOut):
-		return instrumentedLabelValueOptOut
 	default:
 		return instrumentedLabelValueUnknown
 	}
 }
 
+func HasOptedOutOfInstrumenation(meta *metav1.ObjectMeta) bool {
+	if meta.Labels == nil {
+		return false
+	}
+	if value, ok := meta.Labels[optOutLabelKey]; ok && value == "true" {
+		return true
+	}
+	return false
+}
+
 func CheckAndDeleteIgnoreOnceLabel(meta *metav1.ObjectMeta) bool {
 	if meta.Labels == nil {
 		return false
 	}
-	if value, ok := meta.Labels[webhookIgnoreOnceLabelKey]; ok && value == "true" {
+	if value, ok := meta.Labels[webhookIgnoreOnceLabelKey]; ok {
 		delete(meta.Labels, webhookIgnoreOnceLabelKey)
-		return true
+		return value == "true"
 	}
 	return false
 }
diff --git a/internal/webhook/dash0_webhook.go b/internal/webhook/dash0_webhook.go
index 2bc94481..8ef45b79 100644
--- a/internal/webhook/dash0_webhook.go
+++ b/internal/webhook/dash0_webhook.go
@@ -113,7 +113,7 @@ func (h *Handler) handleCronJob(
 		return h.postProcess(request, cronJob, false, true, logger)
 	}
 	if util.HasOptedOutOfInstrumenation(&cronJob.ObjectMeta) {
-		return admission.Allowed("not instrumenting this resource due to dash0.instrumented=false (opt-out)")
+		return admission.Allowed("not instrumenting this resource due to dash0.com/opt-out=true")
 	}
 	hasBeenModified := h.newWorkloadModifier(logger).ModifyCronJob(cronJob)
 	return h.postProcess(request, cronJob, hasBeenModified, false, logger)
@@ -133,7 +133,7 @@ func (h *Handler) handleDaemonSet(
 		return h.postProcess(request, daemonSet, false, true, logger)
 	}
 	if util.HasOptedOutOfInstrumenation(&daemonSet.ObjectMeta) {
-		return admission.Allowed("not instrumenting this resource due to dash0.instrumented=false (opt-out)")
+		return admission.Allowed("not instrumenting this resource due to dash0.com/opt-out=true")
 	}
 	hasBeenModified := h.newWorkloadModifier(logger).ModifyDaemonSet(daemonSet)
 	return h.postProcess(request, daemonSet, hasBeenModified, false, logger)
@@ -153,7 +153,7 @@ func (h *Handler) handleDeployment(
 		return h.postProcess(request, deployment, false, true, logger)
 	}
 	if util.HasOptedOutOfInstrumenation(&deployment.ObjectMeta) {
-		return admission.Allowed("not instrumenting this resource due to dash0.instrumented=false (opt-out)")
+		return admission.Allowed("not instrumenting this resource due to dash0.com/opt-out=true")
 	}
 	hasBeenModified := h.newWorkloadModifier(logger).ModifyDeployment(deployment)
 	return h.postProcess(request, deployment, hasBeenModified, false, logger)
@@ -173,7 +173,7 @@ func (h *Handler) handleJob(
 		return h.postProcess(request, job, false, true, logger)
 	}
 	if util.HasOptedOutOfInstrumenation(&job.ObjectMeta) {
-		return admission.Allowed("not instrumenting this resource due to dash0.instrumented=false (opt-out)")
+		return admission.Allowed("not instrumenting this resource due to dash0.com/opt-out=true")
 	}
 	hasBeenModified := h.newWorkloadModifier(logger).ModifyJob(job)
 	return h.postProcess(request, job, hasBeenModified, false, logger)
@@ -193,7 +193,7 @@ func (h *Handler) handleReplicaSet(
 		return h.postProcess(request, replicaSet, false, true, logger)
 	}
 	if util.HasOptedOutOfInstrumenation(&replicaSet.ObjectMeta) {
-		return admission.Allowed("not instrumenting this resource due to dash0.instrumented=false (opt-out)")
+		return admission.Allowed("not instrumenting this resource due to dash0.com/opt-out=true")
 	}
 	hasBeenModified := h.newWorkloadModifier(logger).ModifyReplicaSet(replicaSet)
 	return h.postProcess(request, replicaSet, hasBeenModified, false, logger)
@@ -213,7 +213,7 @@ func (h *Handler) handleStatefulSet(
 		return h.postProcess(request, statefulSet, false, true, logger)
 	}
 	if util.HasOptedOutOfInstrumenation(&statefulSet.ObjectMeta) {
-		return admission.Allowed("not instrumenting this resource due to dash0.instrumented=false (opt-out)")
+		return admission.Allowed("not instrumenting this resource due to dash0.com/out-out=true")
 	}
 	hasBeenModified := h.newWorkloadModifier(logger).ModifyStatefulSet(statefulSet)
 	return h.postProcess(request, statefulSet, hasBeenModified, false, logger)
@@ -252,7 +252,7 @@ func (h *Handler) postProcess(
 	}
 
 	if ignored {
-		logger.Info("Ignoring this admission request due to the presence of dash0.webhook.ignore.once")
+		logger.Info("Ignoring this admission request due to the presence of dash0.com/webhook-ignore-once")
 		// deliberately not queueing an event for this case
 		return admission.PatchResponseFromRaw(request.Object.Raw, marshalled)
 	}
diff --git a/internal/webhook/dash0_webhook_test.go b/internal/webhook/dash0_webhook_test.go
index 9dde62b8..0ec11def 100644
--- a/internal/webhook/dash0_webhook_test.go
+++ b/internal/webhook/dash0_webhook_test.go
@@ -169,7 +169,6 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(CronJobNamePrefix)
 			workload := CronJobWithOptOutLabel(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.instrumented", "false")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetCronJob(ctx, k8sClient, TestNamespaceName, name)
 			VerifyCronJobWithOptOutLabel(workload)
@@ -180,7 +179,6 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(DaemonSetNamePrefix)
 			workload := DaemonSetWithOptOutLabel(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.instrumented", "false")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetDaemonSet(ctx, k8sClient, TestNamespaceName, name)
 			VerifyDaemonSetWithOptOutLabel(workload)
@@ -191,7 +189,6 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(DeploymentNamePrefix)
 			workload := DeploymentWithOptOutLabel(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.instrumented", "false")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetDeployment(ctx, k8sClient, TestNamespaceName, name)
 			VerifyDeploymentWithOptOutLabel(workload)
@@ -202,7 +199,6 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(JobNamePrefix)
 			workload := JobWithOptOutLabel(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.instrumented", "false")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetJob(ctx, k8sClient, TestNamespaceName, name)
 			VerifyJobWithOptOutLabel(workload)
@@ -213,7 +209,6 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(ReplicaSetNamePrefix)
 			workload := ReplicaSetWithOptOutLabel(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.instrumented", "false")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetReplicaSet(ctx, k8sClient, TestNamespaceName, name)
 			VerifyReplicaSetWithOptOutLabel(workload)
@@ -224,7 +219,6 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(StatefulSetNamePrefix)
 			workload := StatefulSetWithOptOutLabel(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.instrumented", "false")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetStatefulSet(ctx, k8sClient, TestNamespaceName, name)
 			VerifyStatefulSetWithOptOutLabel(workload)
@@ -237,7 +231,7 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(CronJobNamePrefix)
 			workload := BasicCronJob(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.webhook.ignore.once", "true")
+			AddLabel(&workload.ObjectMeta, "dash0.com/webhook-ignore-once", "true")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetCronJob(ctx, k8sClient, TestNamespaceName, name)
 			VerifyUnmodifiedCronJob(workload)
@@ -249,7 +243,7 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(DaemonSetNamePrefix)
 			workload := BasicDaemonSet(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.webhook.ignore.once", "true")
+			AddLabel(&workload.ObjectMeta, "dash0.com/webhook-ignore-once", "true")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetDaemonSet(ctx, k8sClient, TestNamespaceName, name)
 			VerifyUnmodifiedDaemonSet(workload)
@@ -261,7 +255,7 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(DeploymentNamePrefix)
 			workload := BasicDeployment(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.webhook.ignore.once", "true")
+			AddLabel(&workload.ObjectMeta, "dash0.com/webhook-ignore-once", "true")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetDeployment(ctx, k8sClient, TestNamespaceName, name)
 			VerifyUnmodifiedDeployment(workload)
@@ -273,7 +267,7 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(JobNamePrefix)
 			workload := BasicJob(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.webhook.ignore.once", "true")
+			AddLabel(&workload.ObjectMeta, "dash0.com/webhook-ignore-once", "true")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetJob(ctx, k8sClient, TestNamespaceName, name)
 			VerifyUnmodifiedJob(workload)
@@ -285,7 +279,7 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(ReplicaSetNamePrefix)
 			workload := BasicReplicaSet(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.webhook.ignore.once", "true")
+			AddLabel(&workload.ObjectMeta, "dash0.com/webhook-ignore-once", "true")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetReplicaSet(ctx, k8sClient, TestNamespaceName, name)
 			VerifyUnmodifiedReplicaSet(workload)
@@ -297,7 +291,7 @@ var _ = Describe("The Dash0 webhook", func() {
 			name := UniqueName(StatefulSetNamePrefix)
 			workload := BasicStatefulSet(TestNamespaceName, name)
 			createdObjects = append(createdObjects, workload)
-			AddLabel(&workload.ObjectMeta, "dash0.webhook.ignore.once", "true")
+			AddLabel(&workload.ObjectMeta, "dash0.com/webhook-ignore-once", "true")
 			CreateWorkload(ctx, k8sClient, workload)
 			workload = GetStatefulSet(ctx, k8sClient, TestNamespaceName, name)
 			VerifyUnmodifiedStatefulSet(workload)
diff --git a/test-resources/collector/e2e.values.yaml.template b/test-resources/collector/e2e.values.yaml.template
index ad90c904..0e7fe7b7 100644
--- a/test-resources/collector/e2e.values.yaml.template
+++ b/test-resources/collector/e2e.values.yaml.template
@@ -2,7 +2,7 @@ mode: daemonset
 service:
   enabled: true
 additionalLabels:
-  dash0.instrumented: "false"
+  dash0.com/opt-out: "true"
 resources:
   limits:
     memory: 500Mi
diff --git a/test-resources/collector/manual.values.yaml.template b/test-resources/collector/manual.values.yaml.template
index 77922c93..ec2aa928 100644
--- a/test-resources/collector/manual.values.yaml.template
+++ b/test-resources/collector/manual.values.yaml.template
@@ -2,7 +2,7 @@ mode: daemonset
 service:
   enabled: true
 additionalLabels:
-   dash0.instrumented: "false"
+   dash0.com/opt-out: "true"
 resources:
   limits:
     memory: 500Mi
diff --git a/test/e2e/e2e_helpers.go b/test/e2e/e2e_helpers.go
index 2e2dd292..ab4535d4 100644
--- a/test/e2e/e2e_helpers.go
+++ b/test/e2e/e2e_helpers.go
@@ -644,31 +644,29 @@ func VerifyThatFailedInstrumentationAttemptLabelsHaveBeenRemovedRemoved(namespac
 }
 
 func verifyLabels(g Gomega, namespace string, kind string, successful bool, instrumentationBy string) {
-	var expectedDash0InstrumentationValue string
-	if successful {
-		expectedDash0InstrumentationValue = "successful"
-	} else {
-		expectedDash0InstrumentationValue = "unsuccessful"
-	}
-	instrumented := readLabel(g, namespace, kind, "dash0.instrumented")
-	g.ExpectWithOffset(1, instrumented).To(Equal(expectedDash0InstrumentationValue))
-	operatorVersion := readLabel(g, namespace, kind, "dash0.operator.version")
+	instrumented := readLabel(g, namespace, kind, "dash0.com/instrumented")
+	g.ExpectWithOffset(1, instrumented).To(Equal(strconv.FormatBool(successful)))
+	operatorVersion := readLabel(g, namespace, kind, "dash0.com/operator-version")
 	g.ExpectWithOffset(1, operatorVersion).To(MatchRegexp("\\d+\\.\\d+\\.\\d+"))
-	initContainerImageVersion := readLabel(g, namespace, kind, "dash0.initcontainer.image.version")
+	initContainerImageVersion := readLabel(g, namespace, kind, "dash0.com/init-container-image-version")
 	g.ExpectWithOffset(1, initContainerImageVersion).To(MatchRegexp("\\d+\\.\\d+\\.\\d+"))
-	instrumentedBy := readLabel(g, namespace, kind, "dash0.instrumented.by")
+	instrumentedBy := readLabel(g, namespace, kind, "dash0.com/instrumented-by")
 	g.ExpectWithOffset(1, instrumentedBy).To(Equal(instrumentationBy))
+	optOut := readLabel(g, namespace, kind, "dash0.com/opt-out")
+	g.ExpectWithOffset(1, optOut).To(Equal(""))
 }
 
 func verifyLabelsHaveBeenRemoved(g Gomega, namespace string, kind string) {
-	instrumented := readLabel(g, namespace, kind, "dash0.instrumented")
+	instrumented := readLabel(g, namespace, kind, "dash0.com/instrumented")
 	g.ExpectWithOffset(1, instrumented).To(Equal(""))
-	operatorVersion := readLabel(g, namespace, kind, "dash0.operator.version")
+	operatorVersion := readLabel(g, namespace, kind, "dash0.com/operator-version")
 	g.ExpectWithOffset(1, operatorVersion).To(Equal(""))
-	initContainerImageVersion := readLabel(g, namespace, kind, "dash0.initcontainer.image.version")
+	initContainerImageVersion := readLabel(g, namespace, kind, "dash0.com/init-container-image-version")
 	g.ExpectWithOffset(1, initContainerImageVersion).To(Equal(""))
-	instrumentedBy := readLabel(g, namespace, kind, "dash0.instrumented.by")
+	instrumentedBy := readLabel(g, namespace, kind, "dash0.com/instrumented-by")
 	g.ExpectWithOffset(1, instrumentedBy).To(Equal(""))
+	optOut := readLabel(g, namespace, kind, "dash0.com/opt-out")
+	g.ExpectWithOffset(1, optOut).To(Equal(""))
 }
 
 func readLabel(g Gomega, namespace string, kind string, labelKey string) string {
diff --git a/test/util/resources.go b/test/util/resources.go
index d7d71206..07d9c3d0 100644
--- a/test/util/resources.go
+++ b/test/util/resources.go
@@ -6,6 +6,7 @@ package util
 import (
 	"context"
 	"fmt"
+	"strconv"
 
 	"github.com/google/uuid"
 	appsv1 "k8s.io/api/apps/v1"
@@ -908,20 +909,14 @@ func GetStatefulSet(
 }
 
 func addInstrumentationLabels(meta *metav1.ObjectMeta, successful bool) {
-	var instrumentationState string
-	if successful {
-		instrumentationState = "successful"
-	} else {
-		instrumentationState = "unsuccessful"
-	}
-	AddLabel(meta, "dash0.instrumented", instrumentationState)
-	AddLabel(meta, "dash0.operator.version", "1.2.3")
-	AddLabel(meta, "dash0.initcontainer.image.version", "4.5.6")
-	AddLabel(meta, "dash0.instrumented.by", "someone")
+	AddLabel(meta, "dash0.com/instrumented", strconv.FormatBool(successful))
+	AddLabel(meta, "dash0.com/operator-version", "1.2.3")
+	AddLabel(meta, "dash0.com/init-container-image-version", "4.5.6")
+	AddLabel(meta, "dash0.com/instrumented-by", "someone")
 }
 
 func addOptOutLabel(meta *metav1.ObjectMeta) {
-	AddLabel(meta, "dash0.instrumented", "false")
+	AddLabel(meta, "dash0.com/opt-out", "true")
 }
 
 func AddLabel(meta *metav1.ObjectMeta, key string, value string) {
diff --git a/test/util/verification.go b/test/util/verification.go
index 0f31a20f..d010d760 100644
--- a/test/util/verification.go
+++ b/test/util/verification.go
@@ -252,39 +252,45 @@ func verifyUnmodifiedPodSpec(podSpec corev1.PodSpec) {
 }
 
 func verifyLabelsAfterSuccessfulModification(meta metav1.ObjectMeta) {
-	Expect(meta.Labels["dash0.instrumented"]).To(Equal("successful"))
-	Expect(meta.Labels["dash0.operator.version"]).To(Equal("1.2.3"))
-	Expect(meta.Labels["dash0.initcontainer.image.version"]).To(Equal("4.5.6"))
-	Expect(meta.Labels["dash0.instrumented.by"]).NotTo(Equal(""))
+	Expect(meta.Labels["dash0.com/instrumented"]).To(Equal("true"))
+	Expect(meta.Labels["dash0.com/operator-version"]).To(Equal("1.2.3"))
+	Expect(meta.Labels["dash0.com/init-container-image-version"]).To(Equal("4.5.6"))
+	Expect(meta.Labels["dash0.com/instrumented-by"]).NotTo(Equal(""))
+	Expect(meta.Labels["dash0.com/opt-out"]).To(Equal(""))
 }
 
 func verifyLabelsAfterFailureToModify(meta metav1.ObjectMeta) {
-	Expect(meta.Labels["dash0.instrumented"]).To(Equal("unsuccessful"))
-	Expect(meta.Labels["dash0.operator.version"]).To(Equal("1.2.3"))
-	Expect(meta.Labels["dash0.initcontainer.image.version"]).To(Equal("4.5.6"))
-	Expect(meta.Labels["dash0.instrumented.by"]).NotTo(Equal(""))
+	Expect(meta.Labels["dash0.com/instrumented"]).To(Equal("false"))
+	Expect(meta.Labels["dash0.com/operator-version"]).To(Equal("1.2.3"))
+	Expect(meta.Labels["dash0.com/init-container-image-version"]).To(Equal("4.5.6"))
+	Expect(meta.Labels["dash0.com/instrumented-by"]).NotTo(Equal(""))
+	Expect(meta.Labels["dash0.com/webhook-ignore-once"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/opt-out"]).To(Equal(""))
 }
 
 func verifyNoDash0Labels(meta metav1.ObjectMeta) {
-	Expect(meta.Labels["dash0.instrumented"]).To(Equal(""))
-	Expect(meta.Labels["dash0.operator.version"]).To(Equal(""))
-	Expect(meta.Labels["dash0.initcontainer.image.version"]).To(Equal(""))
-	Expect(meta.Labels["dash0.instrumented.by"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/instrumented"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/operator-version"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/init-container-image-version"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/instrumented-by"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/opt-out"]).To(Equal(""))
 }
 
 func verifyLabelsForOptOutWorkload(meta metav1.ObjectMeta) {
-	Expect(meta.Labels["dash0.instrumented"]).To(Equal("false"))
-	Expect(meta.Labels["dash0.operator.version"]).To(Equal(""))
-	Expect(meta.Labels["dash0.initcontainer.image.version"]).To(Equal(""))
-	Expect(meta.Labels["dash0.instrumented.by"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/instrumented"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/operator-version"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/init-container-image-version"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/instrumented-by"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/webhook-ignore-once"]).To(Equal(""))
+	Expect(meta.Labels["dash0.com/opt-out"]).To(Equal("true"))
 }
 
 func VerifyWebhookIgnoreOnceLabelIsPresent(objectMeta *metav1.ObjectMeta) bool {
-	return Expect(objectMeta.Labels["dash0.webhook.ignore.once"]).To(Equal("true"))
+	return Expect(objectMeta.Labels["dash0.com/webhook-ignore-once"]).To(Equal("true"))
 }
 
 func VerifyWebhookIgnoreOnceLabelIsAbesent(objectMeta *metav1.ObjectMeta) bool {
-	return Expect(objectMeta.Labels["dash0.webhook.ignore.once"]).To(Equal(""))
+	return Expect(objectMeta.Labels["dash0.com/webhook-ignore-once"]).To(Equal(""))
 }
 
 func VerifyNoEvents(