diff --git a/core/BUILD b/core/BUILD
index ef4b86a..03a5153 100644
--- a/core/BUILD
+++ b/core/BUILD
@@ -10,7 +10,6 @@
         "@com_github_containernetworking_plugins//plugins/main/loopback",
         "@com_github_containernetworking_plugins//plugins/main/ptp",
         "@com_github_containernetworking_plugins//plugins/ipam/host-local",
-        "@com_github_opencontainers_runc//:runc",
         "@com_github_google_gvisor//runsc",
         "@com_github_google_gvisor_containerd_shim//cmd/containerd-shim-runsc-v1",
         "//core/internal/containerd:ptp.json",
diff --git a/core/internal/kubernetes/reconcile.go b/core/internal/kubernetes/reconcile.go
index 93ee4da..b000883 100644
--- a/core/internal/kubernetes/reconcile.go
+++ b/core/internal/kubernetes/reconcile.go
@@ -116,6 +116,9 @@
 	{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: rbac("psp-default"),
+			Labels: map[string]string{
+				"smalltown.com/builtin": "true",
+			},
 			Annotations: map[string]string{
 				"kubernetes.io/description": "This role grants access to the \"default\" PSP.",
 			},
@@ -135,6 +138,9 @@
 	{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: rbac("default-psp-for-sa"),
+			Labels: map[string]string{
+				"smalltown.com/builtin": "true",
+			},
 			Annotations: map[string]string{
 				"kubernetes.io/description": "This binding grants every service account access to the \"default\" PSP. " +
 					"Creation of Pods is still restricted by other RBAC roles. Otherwise no pods (unprivileged or not) " +
@@ -157,6 +163,9 @@
 	{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: rbac("apiserver-kubelet-client"),
+			Labels: map[string]string{
+				"smalltown.com/builtin": "true",
+			},
 			Annotations: map[string]string{
 				"kubernetes.io/description": "This binding grants the apiserver access to the kubelets. This enables " +
 					"lots of built-in functionality like reading logs or forwarding ports via the API.",