diff --git a/config.tf b/config.tf
index a70992438f3..f9ee9f58602 100644
--- a/config.tf
+++ b/config.tf
@@ -65,6 +65,7 @@ variable "tectonic_container_images" {
     hyperkube                            = "openshift/origin-node:latest"
     kube_core_renderer                   = "quay.io/coreos/kube-core-renderer-dev:3b6952f5a1ba89bb32dd0630faddeaf2779c9a85"
     kube_core_operator                   = "quay.io/coreos/kube-core-operator-dev:3b6952f5a1ba89bb32dd0630faddeaf2779c9a85"
+    cluster_openshift_apiserver_operator = "openshift/origin-cluster-openshift-apiserver-operator:latest"
     tectonic_channel_operator            = "quay.io/coreos/tectonic-channel-operator-dev:3b6952f5a1ba89bb32dd0630faddeaf2779c9a85"
     kube_addon_operator                  = "quay.io/coreos/kube-addon-operator-dev:3b6952f5a1ba89bb32dd0630faddeaf2779c9a85"
     tectonic_alm_operator                = "quay.io/coreos/tectonic-alm-operator:v0.3.1"
diff --git a/modules/tectonic/manifests.tf b/modules/tectonic/manifests.tf
index 6a9a27f0394..51417679940 100644
--- a/modules/tectonic/manifests.tf
+++ b/modules/tectonic/manifests.tf
@@ -29,6 +29,7 @@ variable "manifest_names" {
     "updater/operators/tectonic-channel-operator.yaml",
     "updater/operators/tectonic-ingress-controller-operator.yaml",
     "updater/operators/tectonic-utility-operator.yaml",
+    "updater/operators/cluster-openshift-apiserver-operator.yaml",
     "updater/tectonic-channel-operator-config.yaml",
     "updater/tectonic-channel-operator-kind.yaml",
   ]
@@ -47,6 +48,7 @@ data "template_file" "manifest_file_list" {
     tectonic_alm_operator_image                = "${var.container_images["tectonic_alm_operator"]}"
     tectonic_ingress_controller_operator_image = "${var.container_images["tectonic_ingress_controller_operator"]}"
     tectonic_utility_operator_image            = "${var.container_images["tectonic_utility_operator"]}"
+    cluster_openshift_apiserver_operator_image = "${var.container_images["cluster_openshift_apiserver_operator"]}"
 
     config_reload_base_image      = "${var.container_base_images["config_reload"]}"
     addon_resizer_base_image      = "${var.container_base_images["addon_resizer"]}"
diff --git a/modules/tectonic/resources/manifests/updater/operators/cluster-openshift-apiserver-operator.yaml b/modules/tectonic/resources/manifests/updater/operators/cluster-openshift-apiserver-operator.yaml
new file mode 100644
index 00000000000..b9c82014db6
--- /dev/null
+++ b/modules/tectonic/resources/manifests/updater/operators/cluster-openshift-apiserver-operator.yaml
@@ -0,0 +1,106 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    openshift.io/run-level: "0"
+  name: openshift-core-operators
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: openshiftapiserveroperatorconfigs.openshiftapiserver.operator.openshift.io
+spec:
+  scope: Cluster
+  group: openshiftapiserver.operator.openshift.io
+  version: v1alpha1
+  names:
+    kind: OpenShiftAPIServerOperatorConfig
+    plural: openshiftapiserveroperatorconfigs
+    singular: openshiftapiserveroperatorconfig
+    categories:
+    - coreoperators
+  subresources:
+    status: {}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:openshift:operator:cluster-openshift-apiserver-operator
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  namespace: openshift-core-operators
+  name: openshift-cluster-openshift-apiserver-operator
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: openshift-core-operators
+  name: openshift-cluster-openshift-apiserver-operator-config
+data:
+  config.yaml: |
+    apiVersion: operator.openshift.io/v1alpha1
+    kind: GenericOperatorConfig
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: openshift-core-operators
+  name: openshift-cluster-openshift-apiserver-operator
+  labels:
+    app: openshift-cluster-openshift-apiserver-operator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: openshift-cluster-openshift-apiserver-operator
+  template:
+    metadata:
+      name: openshift-cluster-openshift-apiserver-operator
+      labels:
+        app: openshift-cluster-openshift-apiserver-operator
+    spec:
+      serviceAccountName: openshift-cluster-openshift-apiserver-operator
+      containers:
+      - name: operator
+        image: ${cluster_openshift_apiserver_operator_image}
+        imagePullPolicy: IfNotPresent
+        command: ["cluster-openshift-apiserver-operator", "operator"]
+        args:
+        - "--config=/var/run/configmaps/config/config.yaml"
+        - "-v=4"
+        volumeMounts:
+        - mountPath: /var/run/configmaps/config
+          name: config
+      volumes:
+      - name: serving-cert
+        secret:
+          defaultMode: 400
+          secretName: openshift-cluster-openshift-apiserver-operator-serving-cert
+          optional: true
+      - name: config
+        configMap:
+          defaultMode: 440
+          name: openshift-cluster-openshift-apiserver-operator-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: openshift-core-operators
+  name: openshift-cluster-openshift-apiserver-operator
+  labels:
+    app: openshift-cluster-openshift-apiserver-operator
+---
+apiVersion: openshiftapiserver.operator.openshift.io/v1alpha1
+kind: OpenShiftAPIServerOperatorConfig
+metadata:
+  name: instance
+spec:
+  managementState: Managed
+  imagePullSpec: openshift/origin-hypershift:latest
+  version: 3.11.0
+  logging:
+    level: 4
+  replicas: 2
diff --git a/modules/tectonic/resources/tectonic.sh b/modules/tectonic/resources/tectonic.sh
index db6dc3ec7f1..b4575f79f50 100755
--- a/modules/tectonic/resources/tectonic.sh
+++ b/modules/tectonic/resources/tectonic.sh
@@ -92,6 +92,7 @@ kubectl create --filename updater/operators/kube-addon-operator.yaml
 kubectl create --filename updater/operators/tectonic-alm-operator.yaml
 kubectl create --filename updater/operators/tectonic-utility-operator.yaml
 kubectl create --filename updater/operators/tectonic-ingress-controller-operator.yaml
+kubectl create --filename updater/operators/cluster-openshift-apiserver-operator.yaml
 
 kubectl --namespace=tectonic-system get customresourcedefinition appversions.tco.coreos.com
 kubectl create --filename updater/app_versions/app-version-tectonic-cluster.yaml