diff --git a/pkg/centralsensor/caps_list.go b/pkg/centralsensor/caps_list.go
index 6a90ecbaa50b8..2cbfbdf727d5a 100644
--- a/pkg/centralsensor/caps_list.go
+++ b/pkg/centralsensor/caps_list.go
@@ -109,4 +109,9 @@ const (
 	// VirtualMachineTelemetryCap lets Central distinguish "VM scanning off on
 	// a new Sensor" from "old Sensor that predates VM telemetry fields."
 	VirtualMachineTelemetryCap SensorCapability = "VirtualMachineTelemetry"
+
+	// WorkloadTypeExclusionCap identifies the capability of Sensor to honor
+	// Exclusion.exclude_by_type rules. Central strips those rules when syncing
+	// policies to Sensors that lack this capability.
+	WorkloadTypeExclusionCap SensorCapability = "WorkloadTypeExclusion"
 )
diff --git a/pkg/features/list.go b/pkg/features/list.go
index dc632d82f305f..f650124fef654 100644
--- a/pkg/features/list.go
+++ b/pkg/features/list.go
@@ -146,6 +146,9 @@ var (
 	// EvaluationFilter enables evaluation filtering in policy evaluation.
 	EvaluationFilter = registerFeature("Enable evaluation filtering in policy evaluation", "ROX_EVALUATION_FILTER", enabled)
 
+	// PolicyWorkloadTypeExclusion enables excluding all workloads of selected Kubernetes kinds (Job, CronJob) from a policy.
+	PolicyWorkloadTypeExclusion = registerFeature("Enable excluding all workloads of a given type from a policy", "ROX_POLICY_WORKLOAD_TYPE_EXCLUSION")
+
 	// UISecretsPageMigration enables the secrets list page under the Risk section
 	UISecretsPageMigration = registerFeature("Display secrets list page under Risk section", "ROX_UI_SECRETS_PAGE_MIGRATION")
 
diff --git a/sensor/common/detector/detector.go b/sensor/common/detector/detector.go
index ef9b94103e2ef..91a329abf3c20 100644
--- a/sensor/common/detector/detector.go
+++ b/sensor/common/detector/detector.go
@@ -427,7 +427,11 @@ func (d *detectorImpl) Notify(e common.SensorComponentEvent) {
 }
 
 func (d *detectorImpl) Capabilities() []centralsensor.SensorCapability {
-	return []centralsensor.SensorCapability{centralsensor.SensorDetectionCap}
+	caps := []centralsensor.SensorCapability{centralsensor.SensorDetectionCap}
+	if features.PolicyWorkloadTypeExclusion.Enabled() {
+		caps = append(caps, centralsensor.WorkloadTypeExclusionCap)
+	}
+	return caps
 }
 
 // ProcessPolicySync reconciles policies and flush all deployments through the detector
diff --git a/tests/e2e/lib-compat.sh b/tests/e2e/lib-compat.sh
index f48b7e4dfecc8..85b686fcbfec2 100644
--- a/tests/e2e/lib-compat.sh
+++ b/tests/e2e/lib-compat.sh
@@ -205,6 +205,7 @@ collect_feature_flags() {
     env_with_default ROX_NODE_VULNERABILITY_REPORTS "true"
     env_with_default ROX_TAILORED_PROFILES "true"
     env_with_default ROX_INIT_CONTAINER_SUPPORT "true"
+    env_with_default ROX_POLICY_WORKLOAD_TYPE_EXCLUSION "true"
     env_with_default ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL "true"
     env_with_default ROX_LABEL_BASED_POLICY_SCOPING "true"
     env_with_default ROX_POLICY_CRITERIA_MODAL "true"
diff --git a/tests/e2e/lib.sh b/tests/e2e/lib.sh
index 545859fefc55b..3f074bec50f45 100755
--- a/tests/e2e/lib.sh
+++ b/tests/e2e/lib.sh
@@ -444,6 +444,7 @@ export_test_environment() {
     ci_export ROX_NETFLOW_BATCHING "${ROX_NETFLOW_BATCHING:-true}"
     ci_export ROX_NETFLOW_CACHE_LIMITING "${ROX_NETFLOW_CACHE_LIMITING:-true}"
     ci_export ROX_INIT_CONTAINER_SUPPORT "${ROX_INIT_CONTAINER_SUPPORT:-true}"
+    ci_export ROX_POLICY_WORKLOAD_TYPE_EXCLUSION "${ROX_POLICY_WORKLOAD_TYPE_EXCLUSION:-true}"
     ci_export ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL "${ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL:-true}"
     ci_export ROX_UI_SECRETS_PAGE_MIGRATION "${ROX_UI_SECRETS_PAGE_MIGRATION:-true}"
     ci_export ROX_AI_INTEGRATIONS "${ROX_AI_INTEGRATIONS:-true}"
@@ -624,6 +625,8 @@ deploy_central_via_operator() {
     customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_INIT_CONTAINER_SUPPORT'
     customize_envVars+=$'\n        value: "true"'
+    customize_envVars+=$'\n      - name: ROX_POLICY_WORKLOAD_TYPE_EXCLUSION'
+    customize_envVars+=$'\n        value: "true"'
     customize_envVars+=$'\n      - name: ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL'
     customize_envVars+=$'\n        value: "'"${ROX_VIRTUAL_MACHINES_ENHANCED_DATA_MODEL:-true}"'"'
     customize_envVars+=$'\n      - name: ROX_UI_SECRETS_PAGE_MIGRATION'
@@ -775,6 +778,10 @@ deploy_sensor_via_operator() {
         customize_envVars+=$'\n    - name: ROX_INIT_CONTAINER_SUPPORT'
         customize_envVars+=$'\n      value: "'"${ROX_INIT_CONTAINER_SUPPORT}"'"'
     fi
+    if [[ -n "${ROX_POLICY_WORKLOAD_TYPE_EXCLUSION:-}" ]]; then
+        customize_envVars+=$'\n    - name: ROX_POLICY_WORKLOAD_TYPE_EXCLUSION'
+        customize_envVars+=$'\n      value: "'"${ROX_POLICY_WORKLOAD_TYPE_EXCLUSION}"'"'
+    fi
 
     local scannerV4DbPersistenceYaml
     scannerV4DbPersistenceYaml="$(_scanner_v4_db_persistence_yaml)"