diff --git a/controllers/workspace/devworkspace_controller.go b/controllers/workspace/devworkspace_controller.go
index f0c8600ed..92df4a44b 100644
--- a/controllers/workspace/devworkspace_controller.go
+++ b/controllers/workspace/devworkspace_controller.go
@@ -413,6 +413,9 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		allPodAdditions = append(allPodAdditions, *routingPodAdditions)
 	}
 
+	annotationAdditions := controllerv1alpha1.PodAdditions{Annotations: workspace.Config.Workspace.PodAnnotations}
+	allPodAdditions = append(allPodAdditions, annotationAdditions)
+
 	// Step five: Prepare workspace ServiceAccount
 	var serviceAcctName string
 	if *workspace.Config.Workspace.ServiceAccount.DisableCreation {
diff --git a/pkg/config/sync.go b/pkg/config/sync.go
index 3d26abf74..32a17d084 100644
--- a/pkg/config/sync.go
+++ b/pkg/config/sync.go
@@ -384,6 +384,15 @@ func mergeConfig(from, to *controller.OperatorConfiguration) {
 			}
 			to.Workspace.DefaultContainerResources = mergeResources(from.Workspace.DefaultContainerResources, to.Workspace.DefaultContainerResources)
 		}
+
+		if from.Workspace.PodAnnotations != nil {
+			if to.Workspace.PodAnnotations == nil {
+				to.Workspace.PodAnnotations = make(map[string]string)
+			}
+			for key, value := range from.Workspace.PodAnnotations {
+				to.Workspace.PodAnnotations[key] = value
+			}
+		}
 	}
 }
 
@@ -586,6 +595,9 @@ func GetCurrentConfigString(currConfig *controller.OperatorConfiguration) string
 		if !reflect.DeepEqual(workspace.DefaultContainerResources, defaultConfig.Workspace.DefaultContainerResources) {
 			config = append(config, "workspace.defaultContainerResources is set")
 		}
+		if !reflect.DeepEqual(workspace.PodAnnotations, defaultConfig.Workspace.PodAnnotations) {
+			config = append(config, "workspace.podAnnotations is set")
+		}
 	}
 	if currConfig.EnableExperimentalFeatures != nil && *currConfig.EnableExperimentalFeatures {
 		config = append(config, "enableExperimentalFeatures=true")
diff --git a/pkg/provision/workspace/deployment.go b/pkg/provision/workspace/deployment.go
index aa2b27f02..d05709915 100644
--- a/pkg/provision/workspace/deployment.go
+++ b/pkg/provision/workspace/deployment.go
@@ -197,6 +197,7 @@ func getSpecDeployment(
 						constants.DevWorkspaceIDLabel:   workspace.Status.DevWorkspaceId,
 						constants.DevWorkspaceNameLabel: workspace.Name,
 					},
+					Annotations: podAdditions.Annotations,
 				},
 				Spec: corev1.PodSpec{
 					InitContainers:                podAdditions.InitContainers,
@@ -300,9 +301,15 @@ func mergePodAdditions(toMerge []v1alpha1.PodAdditions) (*v1alpha1.PodAdditions,
 	pullSecretNames := map[string]bool{}
 	for _, additions := range toMerge {
 		for annotKey, annotVal := range additions.Annotations {
+			if podAdditions.Annotations == nil {
+				podAdditions.Annotations = map[string]string{}
+			}
 			podAdditions.Annotations[annotKey] = annotVal
 		}
 		for labelKey, labelVal := range additions.Labels {
+			if podAdditions.Labels == nil {
+				podAdditions.Labels = map[string]string{}
+			}
 			podAdditions.Labels[labelKey] = labelVal
 		}
 		for _, container := range additions.Containers {