diff --git a/api/v1alpha1/ref_types.go b/api/v1alpha1/ref_types.go
index 828fe51..7ae5907 100644
--- a/api/v1alpha1/ref_types.go
+++ b/api/v1alpha1/ref_types.go
@@ -13,7 +13,8 @@ type OIDCAppRef struct {
 }
 
 // OrganizationRef can reference an organization via K8s object or direct Zitadel ID
-// +kubebuilder:validation:XValidation:rule="has(self.name) == has(self.id)",message="must provide either k8s object reference (name) or zitadel ID reference (id), but not both"
+// +kubebuilder:validation:XValidation:rule="has(self.name) != has(self.id)",message="must provide either k8s object reference (name) or zitadel ID reference (id), but not both"
+// +kubebuilder:validation:XValidation:rule="has(self.name) || has(self.id)",message="must provide either k8s object reference (name) or zitadel ID reference (id)"
 // +kubebuilder:validation:XValidation:rule="!has(self.id) || has(self.connectionRef.name)",message="zitadel ID reference requires connectionRef.name"
 type OrganizationRef struct {
 	ObjectReference corev1.ObjectReference `json:",inline"`
@@ -22,7 +23,8 @@ type OrganizationRef struct {
 }
 
 // ProjectRef can reference a project via K8s object or direct Zitadel ID
-// +kubebuilder:validation:XValidation:rule="has(self.name) == has(self.id)",message="must provide either k8s object reference (name) or zitadel ID reference (id), but not both"
+// +kubebuilder:validation:XValidation:rule="has(self.name) != has(self.id)",message="must provide either k8s object reference (name) or zitadel ID reference (id), but not both"
+// +kubebuilder:validation:XValidation:rule="has(self.name) || has(self.id)",message="must provide either k8s object reference (name) or zitadel ID reference (id)"
 // +kubebuilder:validation:XValidation:rule="!has(self.id) || has(self.connectionRef.name)",message="zitadel ID reference requires connectionRef.name"
 type ProjectRef struct {
 	ObjectReference corev1.ObjectReference `json:",inline"`
diff --git a/config/crd/bases/zitadel.github.com_actions.yaml b/config/crd/bases/zitadel.github.com_actions.yaml
index 930ed79..4c4f7bb 100644
--- a/config/crd/bases/zitadel.github.com_actions.yaml
+++ b/config/crd/bases/zitadel.github.com_actions.yaml
@@ -134,7 +134,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               script:
diff --git a/config/crd/bases/zitadel.github.com_apiapps.yaml b/config/crd/bases/zitadel.github.com_apiapps.yaml
index 03be1d8..0e5e4dc 100644
--- a/config/crd/bases/zitadel.github.com_apiapps.yaml
+++ b/config/crd/bases/zitadel.github.com_apiapps.yaml
@@ -136,7 +136,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
             required:
diff --git a/config/crd/bases/zitadel.github.com_flows.yaml b/config/crd/bases/zitadel.github.com_flows.yaml
index f3c087f..b8d2f7e 100644
--- a/config/crd/bases/zitadel.github.com_flows.yaml
+++ b/config/crd/bases/zitadel.github.com_flows.yaml
@@ -183,7 +183,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               triggerType:
diff --git a/config/crd/bases/zitadel.github.com_machineusers.yaml b/config/crd/bases/zitadel.github.com_machineusers.yaml
index d0cc34f..93a3639 100644
--- a/config/crd/bases/zitadel.github.com_machineusers.yaml
+++ b/config/crd/bases/zitadel.github.com_machineusers.yaml
@@ -138,7 +138,10 @@ spec:
                       x-kubernetes-validations:
                       - message: must provide either k8s object reference (name) or
                           zitadel ID reference (id), but not both
-                        rule: has(self.name) == has(self.id)
+                        rule: has(self.name) != has(self.id)
+                      - message: must provide either k8s object reference (name) or
+                          zitadel ID reference (id)
+                        rule: has(self.name) || has(self.id)
                       - message: zitadel ID reference requires connectionRef.name
                         rule: '!has(self.id) || has(self.connectionRef.name)'
                     roleKeys:
@@ -294,7 +297,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               username:
diff --git a/config/crd/bases/zitadel.github.com_oidcapps.yaml b/config/crd/bases/zitadel.github.com_oidcapps.yaml
index 26426d0..0455ad3 100644
--- a/config/crd/bases/zitadel.github.com_oidcapps.yaml
+++ b/config/crd/bases/zitadel.github.com_oidcapps.yaml
@@ -182,7 +182,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               redirectUris:
diff --git a/config/crd/bases/zitadel.github.com_projects.yaml b/config/crd/bases/zitadel.github.com_projects.yaml
index 73763e4..1468170 100644
--- a/config/crd/bases/zitadel.github.com_projects.yaml
+++ b/config/crd/bases/zitadel.github.com_projects.yaml
@@ -133,7 +133,10 @@ spec:
                       x-kubernetes-validations:
                       - message: must provide either k8s object reference (name) or
                           zitadel ID reference (id), but not both
-                        rule: has(self.name) == has(self.id)
+                        rule: has(self.name) != has(self.id)
+                      - message: must provide either k8s object reference (name) or
+                          zitadel ID reference (id)
+                        rule: has(self.name) || has(self.id)
                       - message: zitadel ID reference requires connectionRef.name
                         rule: '!has(self.id) || has(self.connectionRef.name)'
                     roleKeys:
@@ -240,7 +243,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               projectName:
diff --git a/ops/chart/crds/action-crd.yaml b/ops/chart/crds/action-crd.yaml
index 2798fd8..2bd5a88 100644
--- a/ops/chart/crds/action-crd.yaml
+++ b/ops/chart/crds/action-crd.yaml
@@ -133,7 +133,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               script:
diff --git a/ops/chart/crds/apiapp-crd.yaml b/ops/chart/crds/apiapp-crd.yaml
index db5eac1..4cf57ae 100644
--- a/ops/chart/crds/apiapp-crd.yaml
+++ b/ops/chart/crds/apiapp-crd.yaml
@@ -135,7 +135,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
             required:
diff --git a/ops/chart/crds/flow-crd.yaml b/ops/chart/crds/flow-crd.yaml
index 46b795e..ce05bfc 100644
--- a/ops/chart/crds/flow-crd.yaml
+++ b/ops/chart/crds/flow-crd.yaml
@@ -182,7 +182,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               triggerType:
diff --git a/ops/chart/crds/machineuser-crd.yaml b/ops/chart/crds/machineuser-crd.yaml
index 54e5ec9..d4efeed 100644
--- a/ops/chart/crds/machineuser-crd.yaml
+++ b/ops/chart/crds/machineuser-crd.yaml
@@ -137,7 +137,10 @@ spec:
                       x-kubernetes-validations:
                       - message: must provide either k8s object reference (name) or
                           zitadel ID reference (id), but not both
-                        rule: has(self.name) == has(self.id)
+                        rule: has(self.name) != has(self.id)
+                      - message: must provide either k8s object reference (name) or
+                          zitadel ID reference (id)
+                        rule: has(self.name) || has(self.id)
                       - message: zitadel ID reference requires connectionRef.name
                         rule: '!has(self.id) || has(self.connectionRef.name)'
                     roleKeys:
@@ -293,7 +296,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               username:
diff --git a/ops/chart/crds/oidcapp-crd.yaml b/ops/chart/crds/oidcapp-crd.yaml
index 8348ce5..9aa5141 100644
--- a/ops/chart/crds/oidcapp-crd.yaml
+++ b/ops/chart/crds/oidcapp-crd.yaml
@@ -181,7 +181,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               redirectUris:
diff --git a/ops/chart/crds/project-crd.yaml b/ops/chart/crds/project-crd.yaml
index 532d8a3..96bfadf 100644
--- a/ops/chart/crds/project-crd.yaml
+++ b/ops/chart/crds/project-crd.yaml
@@ -132,7 +132,10 @@ spec:
                       x-kubernetes-validations:
                       - message: must provide either k8s object reference (name) or
                           zitadel ID reference (id), but not both
-                        rule: has(self.name) == has(self.id)
+                        rule: has(self.name) != has(self.id)
+                      - message: must provide either k8s object reference (name) or
+                          zitadel ID reference (id)
+                        rule: has(self.name) || has(self.id)
                       - message: zitadel ID reference requires connectionRef.name
                         rule: '!has(self.id) || has(self.connectionRef.name)'
                     roleKeys:
@@ -239,7 +242,10 @@ spec:
                 x-kubernetes-validations:
                 - message: must provide either k8s object reference (name) or zitadel
                     ID reference (id), but not both
-                  rule: has(self.name) == has(self.id)
+                  rule: has(self.name) != has(self.id)
+                - message: must provide either k8s object reference (name) or zitadel
+                    ID reference (id)
+                  rule: has(self.name) || has(self.id)
                 - message: zitadel ID reference requires connectionRef.name
                   rule: '!has(self.id) || has(self.connectionRef.name)'
               projectName: