diff --git a/pkg/ee/default-application-catalog/application_catalog.go b/pkg/ee/default-application-catalog/application_catalog.go
index 94fc3569f7..ce4b7cd173 100644
--- a/pkg/ee/default-application-catalog/application_catalog.go
+++ b/pkg/ee/default-application-catalog/application_catalog.go
@@ -58,14 +58,14 @@ func DeployDefaultApplicationCatalog(ctx context.Context, logger *logrus.Entry,
 		return fmt.Errorf("failed to fetch ApplicationDefinitions: %w", err)
 	}
 
-	sublogger.Infof("Waiting for webhook %q with version %q to become ready", common.WebhookDeploymentName, opt.Versions.Kubermatic)
-	operatorDeploySelector := &appsv1.Deployment{
+	sublogger.Info("Waiting for KKP webhook to become ready…")
+	webhook := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      common.WebhookDeploymentName,
 			Namespace: resources.KubermaticNamespace,
 		},
 	}
-	if err := util.WaitForUpdatedDeployment(ctx, operatorDeploySelector, opt.Versions.Kubermatic, kubeClient, 5*time.Minute); err != nil {
+	if err := util.WaitForUpdatedDeployment(ctx, kubeClient, webhook, opt.Versions.Kubermatic, 5*time.Minute); err != nil {
 		return fmt.Errorf("failed waiting for webhook to come ready %w", err)
 	}
 
diff --git a/pkg/install/util/deploy.go b/pkg/install/util/deployment.go
similarity index 51%
rename from pkg/install/util/deploy.go
rename to pkg/install/util/deployment.go
index 67a9157ae8..53ba34dfb0 100644
--- a/pkg/install/util/deploy.go
+++ b/pkg/install/util/deployment.go
@@ -20,32 +20,21 @@ import (
 	"context"
 	"time"
 
+	"k8c.io/kubermatic/v2/pkg/kubernetes"
 	"k8c.io/kubermatic/v2/pkg/resources"
 
 	appsv1 "k8s.io/api/apps/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
 	ctrlruntimeclient "sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-// DeployMatchesVersion returns true if the version label of the deployment matches the supplied version.
-func DeployMatchesVersion(deploy *appsv1.Deployment, version string) bool {
-	return deploy.Labels[resources.VersionLabel] == version
-}
-
-// DeployReplicasReady returns true if all replicas of a deployment are ready.
-func DeployReplicasReady(deploy *appsv1.Deployment) bool {
-	return deploy.Status.ReadyReplicas == *deploy.Spec.Replicas
-}
-
-// WaitForUpdatedDeployment queries k8s until a deployment with the supplied version exists or until the timeout is reached.
-func WaitForUpdatedDeployment(ctx context.Context, deployToWatch *appsv1.Deployment, version string, kubeClient ctrlruntimeclient.Client, timeout time.Duration) error {
+// WaitForUpdatedDeployment queries k8s until a deployment with the supplied version exists and
+// has been rolled out, or until the timeout is reached.
+func WaitForUpdatedDeployment(ctx context.Context, client ctrlruntimeclient.Client, deployment *appsv1.Deployment, version string, timeout time.Duration) error {
 	return wait.PollUntilContextTimeout(ctx, 1*time.Second, timeout, true, func(ctx context.Context) (bool, error) {
-		res := &appsv1.Deployment{}
-		nsn := types.NamespacedName{Namespace: deployToWatch.Namespace, Name: deployToWatch.Name}
-
-		if err := kubeClient.Get(ctx, nsn, res); err != nil {
+		dep := &appsv1.Deployment{}
+		if err := client.Get(ctx, ctrlruntimeclient.ObjectKeyFromObject(deployment), dep); err != nil {
 			if apierrors.IsNotFound(err) {
 				return false, nil
 			}
@@ -53,12 +42,10 @@ func WaitForUpdatedDeployment(ctx context.Context, deployToWatch *appsv1.Deploym
 			return false, err
 		}
 
-		versionCheck := DeployMatchesVersion(res, version)
-		// we can exit early if the Version doesn't match, no need to check for replicas
-		if !versionCheck {
+		if dep.Labels[resources.VersionLabel] != version {
 			return false, nil
 		}
 
-		return DeployReplicasReady(res), nil
+		return kubernetes.IsDeploymentRolloutComplete(dep, 0)
 	})
 }