diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04a5a082..87ffaaf6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,9 +4,11 @@
 
 ### Fixed
 
+- Don't panic on invalid authorization config. Previously, a missing OPA ConfigMap would crash the operator ([#667]).
 - getting_started: Add a 120 second timeout before trying to enable the DAG ([#665]).
 
 [#665]: https://github.com/stackabletech/airflow-operator/pull/665
+[#667]: https://github.com/stackabletech/airflow-operator/pull/667
 
 ## [25.7.0] - 2025-07-23
 
diff --git a/rust/operator-binary/src/airflow_controller.rs b/rust/operator-binary/src/airflow_controller.rs
index ddb972f3..fa526521 100644
--- a/rust/operator-binary/src/airflow_controller.rs
+++ b/rust/operator-binary/src/airflow_controller.rs
@@ -346,6 +346,11 @@ pub enum Error {
 
     #[snafu(display("failed to configure service"))]
     ServiceConfiguration { source: crate::service::Error },
+
+    #[snafu(display("invalid authorization config"))]
+    InvalidAuthorizationConfig {
+        source: stackable_operator::commons::opa::Error,
+    },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -390,7 +395,7 @@ pub async fn reconcile_airflow(
         &airflow.spec.cluster_config.authorization,
     )
     .await
-    .unwrap();
+    .context(InvalidAuthorizationConfigSnafu)?;
 
     let mut roles = HashMap::new();
 
@@ -918,7 +923,7 @@ fn build_server_rolegroup_statefulset(
                 "kubectl.kubernetes.io/default-container",
                 format!("{}", Container::Airflow),
             ))
-            .unwrap(),
+            .expect("static annotation is always valid"),
         )
         .build();