diff --git a/config/package/resources.yaml.gotmpl b/config/package/resources.yaml.gotmpl
index 8bb33654..1f918d56 100644
--- a/config/package/resources.yaml.gotmpl
+++ b/config/package/resources.yaml.gotmpl
@@ -227,6 +227,36 @@ webhooks:
   timeoutSeconds: 2
 ---
 apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    package-operator.run/phase: webhooks
+    service.beta.openshift.io/inject-cabundle: "false"
+  name: sre-network-operator-validation
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    caBundle: '{{.config.serviceca | b64enc }}'
+    url: https://validation-webhook.{{.package.metadata.namespace}}.svc.cluster.local/network-operator-validation
+  failurePolicy: Ignore
+  matchPolicy: Equivalent
+  name: network-operator-validation.managed.openshift.io
+  rules:
+  - apiGroups:
+    - operator.openshift.io
+    apiVersions:
+    - '*'
+    operations:
+    - UPDATE
+    resources:
+    - network
+    - networks
+    scope: Cluster
+  sideEffects: None
+  timeoutSeconds: 2
+---
+apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   annotations:
diff --git a/hack/prow_pr_check.sh b/hack/prow_pr_check.sh
index 96d94dab..7d489b11 100755
--- a/hack/prow_pr_check.sh
+++ b/hack/prow_pr_check.sh
@@ -9,6 +9,10 @@ echo "Using go version $(go version)"
 
 cd "${REPO_ROOT}"
 
+# Prow may set GOFLAGS=-mod=vendor which breaks us since we use modules
+unset GOFLAGS
+export GOFLAGS=-mod=mod
+
 # Run tests
 make test