diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index 309e6578d7..9c286a874c 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -38,3 +38,15 @@ spec:
       maxSurge: 0
       maxUnavailable: 1
 {{- end -}}
+
+{{- /* Returns node selector for workloads, only system or control-plane */ -}}
+{{- define "virt_helper_system_master_node_selector" }}
+{{-   $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}}
+{{-   if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "system" | int) 0 }}
+nodeSelector:
+  node-role.deckhouse.io/system: ""
+{{-   else }}
+nodeSelector:
+  node-role.kubernetes.io/control-plane: ""
+{{-   end }}
+{{- end }}
\ No newline at end of file
diff --git a/templates/kubevirt/virt-operator/deployment.yaml b/templates/kubevirt/virt-operator/deployment.yaml
index 35f93318bd..579d0cbc54 100644
--- a/templates/kubevirt/virt-operator/deployment.yaml
+++ b/templates/kubevirt/virt-operator/deployment.yaml
@@ -150,7 +150,7 @@ spec:
           name: profile-data
         {{- include "kube_api_rewriter.kubeconfig_volume_mount" . | nindent 8 }}
       {{- include "helm_lib_priority_class" (tuple . $priorityClassName) | nindent 6 }}
-      {{- include "helm_lib_node_selector" (tuple . "master") | nindent 6 }}
+      {{- include "virt_helper_system_master_node_selector" (tuple . ) | nindent 6 }}
       {{- include "helm_lib_tolerations" (tuple . "any-node") | nindent 6 }}
       {{- include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . | nindent 6 }}
       serviceAccountName: kubevirt-operator