diff --git a/pkg/console/controllers/migration/cleanup_controller.go b/pkg/console/controllers/migration/cleanup_controller.go
new file mode 100644
index 000000000..32a09253f
--- /dev/null
+++ b/pkg/console/controllers/migration/cleanup_controller.go
@@ -0,0 +1,99 @@
+package migration
+
+import (
+	"context"
+	"fmt"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/klog/v2"
+
+	"github.com/openshift/library-go/pkg/controller/factory"
+	"github.com/openshift/library-go/pkg/operator/events"
+
+	"github.com/openshift/console-operator/pkg/api"
+)
+
+const (
+	ConversionWebhookDeploymentName = "console-conversion-webhook"
+	ConversionWebhookServiceName    = "webhook"
+	ConversionWebhookSecretName     = "webhook-serving-cert"
+)
+
+type MigrationCleanupController struct {
+	kubeClient kubernetes.Interface
+	recorder   events.Recorder
+}
+
+func NewMigrationCleanupController(
+	kubeClient kubernetes.Interface,
+	recorder events.Recorder,
+) factory.Controller {
+	c := &MigrationCleanupController{
+		kubeClient: kubeClient,
+		recorder:   recorder,
+	}
+
+	return factory.New().
+		WithSync(c.Sync).
+		ToController("MigrationCleanupController", recorder)
+}
+
+func (c *MigrationCleanupController) Sync(ctx context.Context, controllerContext factory.SyncContext) error {
+	klog.V(4).Info("Running console-conversion-webhook cleanup from 4.16 → 4.xx migration")
+
+	// Perform cleanup
+	if err := c.cleanupConversionWebhookResources(ctx); err != nil {
+		return fmt.Errorf("failed to cleanup conversion webhook resources: %w", err)
+	}
+
+	return nil
+}
+
+func (c *MigrationCleanupController) cleanupConversionWebhookResources(ctx context.Context) error {
+	var errs []error
+	var deletedResources []string
+
+	// Delete Deployment
+	err := c.kubeClient.AppsV1().Deployments(api.TargetNamespace).Delete(
+		ctx, ConversionWebhookDeploymentName, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		errs = append(errs, fmt.Errorf("failed to delete deployment %s: %w", ConversionWebhookDeploymentName, err))
+	} else if err == nil {
+		klog.V(4).Infof("Deleted deployment: %s", ConversionWebhookDeploymentName)
+		deletedResources = append(deletedResources, "deployment/"+ConversionWebhookDeploymentName)
+	}
+
+	// Delete Service
+	err = c.kubeClient.CoreV1().Services(api.TargetNamespace).Delete(
+		ctx, ConversionWebhookServiceName, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		errs = append(errs, fmt.Errorf("failed to delete service %s: %w", ConversionWebhookServiceName, err))
+	} else if err == nil {
+		klog.V(4).Infof("Deleted service: %s", ConversionWebhookServiceName)
+		deletedResources = append(deletedResources, "service/"+ConversionWebhookServiceName)
+	}
+
+	// Delete Secret
+	err = c.kubeClient.CoreV1().Secrets(api.TargetNamespace).Delete(
+		ctx, ConversionWebhookSecretName, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		errs = append(errs, fmt.Errorf("failed to delete secret %s: %w", ConversionWebhookSecretName, err))
+	} else if err == nil {
+		klog.V(4).Infof("Deleted secret: %s", ConversionWebhookSecretName)
+		deletedResources = append(deletedResources, "secret/"+ConversionWebhookSecretName)
+	}
+
+	// Log summary and emit event if any resources were actually deleted
+	if len(deletedResources) > 0 {
+		klog.V(4).Infof("console-conversion-webhook cleanup completed: deleted %v", deletedResources)
+		c.recorder.Eventf("MigrationCleanupCompleted", "Successfully cleaned up console-conversion-webhook resources: %v", deletedResources)
+	}
+
+	if len(errs) > 0 {
+		return fmt.Errorf("cleanup errors: %v", errs)
+	}
+
+	return nil
+}
diff --git a/pkg/console/starter/starter.go b/pkg/console/starter/starter.go
index 47bb46b54..b17354d3c 100644
--- a/pkg/console/starter/starter.go
+++ b/pkg/console/starter/starter.go
@@ -30,6 +30,7 @@ import (
 	"github.com/openshift/console-operator/pkg/console/controllers/clioidcclientstatus"
 	"github.com/openshift/console-operator/pkg/console/controllers/downloadsdeployment"
 	"github.com/openshift/console-operator/pkg/console/controllers/healthcheck"
+	"github.com/openshift/console-operator/pkg/console/controllers/migration"
 	"github.com/openshift/console-operator/pkg/console/controllers/oauthclients"
 	"github.com/openshift/console-operator/pkg/console/controllers/oauthclientsecret"
 	"github.com/openshift/console-operator/pkg/console/controllers/oidcsetup"
@@ -525,6 +526,11 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle
 		controllerContext.EventRecorder,
 	)
 
+	migrationCleanupController := migration.NewMigrationCleanupController(
+		kubeClient,
+		recorder,
+	)
+
 	// instantiate pdb client
 	policyClient, err := policyv1client.NewForConfig(controllerContext.KubeConfig)
 	if err != nil {
@@ -582,6 +588,7 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle
 	for _, controller := range []interface {
 		Run(ctx context.Context, workers int)
 	}{
+		migrationCleanupController,
 		resourceSyncer,
 		clusterOperatorStatus,
 		logLevelController,