diff --git a/changelogs/unreleased/6775-blackpiglet b/changelogs/unreleased/6775-blackpiglet
new file mode 100644
index 000000000..e7e5d7120
--- /dev/null
+++ b/changelogs/unreleased/6775-blackpiglet
@@ -0,0 +1 @@
+Add PSA audit and warn labels.
\ No newline at end of file
diff --git a/pkg/install/resources.go b/pkg/install/resources.go
index d66e11872..f01e540b9 100644
--- a/pkg/install/resources.go
+++ b/pkg/install/resources.go
@@ -30,6 +30,11 @@ import (
 	velerov1api "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
 )
 
+const (
+	podSecurityLevel   = "privileged"
+	podSecurityVersion = "latest"
+)
+
 var (
 	DefaultVeleroPodCPURequest = "500m"
 	DefaultVeleroPodMemRequest = "128Mi"
@@ -144,8 +149,12 @@ func Namespace(namespace string) *corev1.Namespace {
 		},
 	}
 
-	ns.Labels["pod-security.kubernetes.io/enforce"] = "privileged"
-	ns.Labels["pod-security.kubernetes.io/enforce-version"] = "latest"
+	ns.Labels["pod-security.kubernetes.io/enforce"] = podSecurityLevel
+	ns.Labels["pod-security.kubernetes.io/enforce-version"] = podSecurityVersion
+	ns.Labels["pod-security.kubernetes.io/audit"] = podSecurityLevel
+	ns.Labels["pod-security.kubernetes.io/audit-version"] = podSecurityVersion
+	ns.Labels["pod-security.kubernetes.io/warn"] = podSecurityLevel
+	ns.Labels["pod-security.kubernetes.io/warn-version"] = podSecurityVersion
 
 	return ns
 }
diff --git a/pkg/install/resources_test.go b/pkg/install/resources_test.go
index 298dca9eb..28fc2e452 100644
--- a/pkg/install/resources_test.go
+++ b/pkg/install/resources_test.go
@@ -45,6 +45,10 @@ func TestResources(t *testing.T) {
 	// PSA(Pod Security Admission) and PSS(Pod Security Standards).
 	assert.Equal(t, ns.Labels["pod-security.kubernetes.io/enforce"], "privileged")
 	assert.Equal(t, ns.Labels["pod-security.kubernetes.io/enforce-version"], "latest")
+	assert.Equal(t, ns.Labels["pod-security.kubernetes.io/audit"], "privileged")
+	assert.Equal(t, ns.Labels["pod-security.kubernetes.io/audit-version"], "latest")
+	assert.Equal(t, ns.Labels["pod-security.kubernetes.io/warn"], "privileged")
+	assert.Equal(t, ns.Labels["pod-security.kubernetes.io/warn-version"], "latest")
 
 	crb := ClusterRoleBinding(DefaultVeleroNamespace)
 	// The CRB is a cluster-scoped resource