diff --git a/pkg/defaultmonitortests/types.go b/pkg/defaultmonitortests/types.go
index 84f95b5debdc..f63777e082b3 100644
--- a/pkg/defaultmonitortests/types.go
+++ b/pkg/defaultmonitortests/types.go
@@ -153,6 +153,7 @@ func newDefaultMonitorTests(info monitortestframework.MonitorTestInitializationI
 	monitorTestRegistry.AddMonitorTestOrDie(legacytestframeworkmonitortests.PathologicalMonitorName, "Test Framework", legacytestframeworkmonitortests.NewLegacyPathologicalMonitorTests(info))
 	monitorTestRegistry.AddMonitorTestOrDie("legacy-cvo-invariants", "Cluster Version Operator", legacycvomonitortests.NewLegacyTests())
 	monitorTestRegistry.AddMonitorTestOrDie("node-lifecycle", "Node / Kubelet", watchnodes.NewNodeWatcher())
+	monitorTestRegistry.AddMonitorTestOrDie("oc-adm-upgrade-status", "oc / update", admupgradestatus.NewOcAdmUpgradeStatusChecker())
 
 	return monitorTestRegistry
 }
@@ -220,7 +221,5 @@ func newUniversalMonitorTests(info monitortestframework.MonitorTestInitializatio
 	monitorTestRegistry.AddMonitorTestOrDie("watch-namespaces", "Test Framework", watchnamespaces.NewNamespaceWatcher())
 	monitorTestRegistry.AddMonitorTestOrDie("high-cpu-test-analyzer", "Test Framework", highcputestanalyzer.NewHighCPUTestAnalyzer())
 
-	monitorTestRegistry.AddMonitorTestOrDie("oc-adm-upgrade-status", "oc / update", admupgradestatus.NewOcAdmUpgradeStatusChecker())
-
 	return monitorTestRegistry
 }
diff --git a/pkg/monitortests/kubeapiserver/auditloganalyzer/monitortest.go b/pkg/monitortests/kubeapiserver/auditloganalyzer/monitortest.go
index 94403b10982b..5aa37531cd9a 100644
--- a/pkg/monitortests/kubeapiserver/auditloganalyzer/monitortest.go
+++ b/pkg/monitortests/kubeapiserver/auditloganalyzer/monitortest.go
@@ -228,6 +228,16 @@ func (w *auditLogAnalyzer) EvaluateTestsFromConstructedIntervals(ctx context.Con
 					// These usernames are already creating more than 200 applies, so flake instead of fail.
 					// We really want to find a way to track namespaces created by the payload versus everything else.
 					flakes = append(flakes, errorMessage)
+				case "system:serviceaccount:openshift-machine-config-operator:machine-config-daemon",
+					"system:serviceaccount:openshift-machine-config-operator:machine-config-controller":
+
+					// These usernames produce excessive applies in disruptive suites.
+					// Only flake in disruptive suites; fail in stable suites.
+					if w.clusterStability == monitortestframework.Disruptive {
+						flakes = append(flakes, errorMessage)
+					} else {
+						failures = append(failures, errorMessage)
+					}
 				default:
 					failures = append(failures, errorMessage)
 				}