diff --git a/setup.k8s-v1.30/admission-policy.yaml b/setup.k8s-v1.30/admission-policy.yaml
index ff83f13..d56a3e6 100644
--- a/setup.k8s-v1.30/admission-policy.yaml
+++ b/setup.k8s-v1.30/admission-policy.yaml
@@ -18,6 +18,9 @@ spec:
       apiVersions: ["v1"]
       operations:  ["CREATE", "UPDATE"]
       resources:   ["rayjobs","rayclusters"]
+  matchConditions:
+  - name: exclude-appwrapper-owned
+    expression: "!(has(object.metadata.ownerReferences) && object.metadata.ownerReferences.exists(o, o.apiVersion=='workload.codeflare.dev/v1beta2'&&o.kind=='AppWrapper'&&o.controller))"
   validations:
     - expression: "has(object.metadata.labels) && 'kueue.x-k8s.io/queue-name' in object.metadata.labels && object.metadata.labels['kueue.x-k8s.io/queue-name'] != ''"
       message: "All non-AppWrapper workloads must have a 'kueue.x-k8s.io/queue-name' label with non-empty value."