diff --git a/manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicy.yaml b/manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicy.yaml
new file mode 100644
index 0000000000..2b60e1d22b
--- /dev/null
+++ b/manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicy.yaml
@@ -0,0 +1,22 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "managed-bootimages-cpms-platform-check"
+spec:
+  failurePolicy: Fail
+  paramKind:
+    apiVersion: config.openshift.io/v1
+    kind: Infrastructure
+  matchConstraints:
+    matchPolicy: Equivalent
+    namespaceSelector: {}
+    objectSelector: {}
+    resourceRules:
+    - apiGroups:   ["operator.openshift.io"]
+      apiVersions: ["v1"]
+      operations:  ["CREATE","UPDATE"]
+      resources:   ["machineconfigurations"]
+      scope: "*"
+  validations:
+    - expression: "!has(object.spec.managedBootImages) || !has(object.spec.managedBootImages.machineManagers) || !object.spec.managedBootImages.machineManagers.exists(m, m.resource == 'controlplanemachinesets') || params.status.platformStatus.type in ['GCP','AWS','Azure']"
+      message: "The control plane machineset boot image update feature is only supported on these platforms: GCP, AWS, Azure"
diff --git a/manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicybinding.yaml b/manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicybinding.yaml
new file mode 100644
index 0000000000..fca7759c5d
--- /dev/null
+++ b/manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicybinding.yaml
@@ -0,0 +1,10 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "managed-bootimages-cpms-platform-check-binding"
+spec:
+  policyName: "managed-bootimages-cpms-platform-check"
+  validationActions: [Deny]
+  paramRef:
+    name: "cluster"
+    parameterNotFoundAction: "Deny"
diff --git a/pkg/operator/sync.go b/pkg/operator/sync.go
index 2b54218bea..150aa11127 100644
--- a/pkg/operator/sync.go
+++ b/pkg/operator/sync.go
@@ -104,6 +104,8 @@ const (
 	mccMachineConfigPoolOSImageStreamValidatingAdmissionPolicyBindingPath = "manifests/machineconfigcontroller/machineconfigpool-osimagestream-reference-validatingadmissionpolicybinding.yaml"
 	mccIRIDeletionGuardValidatingAdmissionPolicyPath                      = "manifests/machineconfigcontroller/internalreleaseimage-deletion-guard-validatingadmissionpolicy.yaml"
 	mccIRIDeletionGuardValidatingAdmissionPolicyBindingPath               = "manifests/machineconfigcontroller/internalreleaseimage-deletion-guard-validatingadmissionpolicybinding.yaml"
+	mccUpdateBootImagesCPMSValidatingAdmissionPolicyPath                  = "manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicy.yaml"
+	mccUpdateBootImagesCPMSValidatingAdmissionPolicyBindingPath           = "manifests/machineconfigcontroller/update-bootimages-cpms-validatingadmissionpolicybinding.yaml"
 
 	// Machine OS Builder manifest paths
 	mobClusterRoleManifestPath                      = "manifests/machineosbuilder/clusterrole.yaml"
@@ -1188,6 +1190,10 @@ func (optr *Operator) syncMachineConfigController(config *renderConfig, _ *confi
 		paths.validatingAdmissionPolicies = append(paths.validatingAdmissionPolicies, mccMachineConfigPoolOSImageStreamValidatingAdmissionPolicyPath)
 		paths.validatingAdmissionPolicyBindings = append(paths.validatingAdmissionPolicyBindings, mccMachineConfigPoolOSImageStreamValidatingAdmissionPolicyBindingPath)
 	}
+	if optr.fgHandler.Enabled(features.FeatureGateManagedBootImagesCPMS) {
+		paths.validatingAdmissionPolicies = append(paths.validatingAdmissionPolicies, mccUpdateBootImagesCPMSValidatingAdmissionPolicyPath)
+		paths.validatingAdmissionPolicyBindings = append(paths.validatingAdmissionPolicyBindings, mccUpdateBootImagesCPMSValidatingAdmissionPolicyBindingPath)
+	}
 
 	if optr.fgHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
 		// Only deploy the IRI deletion guard policy if the IRI resource actually exists