diff --git a/pkg/webhook/webhook.go b/pkg/webhook/webhook.go
index d05661197..5b7ed3aac 100644
--- a/pkg/webhook/webhook.go
+++ b/pkg/webhook/webhook.go
@@ -233,7 +233,7 @@ func (m *podMutator) injectProxySidecarContainer(containers []corev1.Container,
 	}
 
 	logLevel := currentLogLevel() // run the proxy at the same log level as the webhook
-	containers = append(containers, corev1.Container{
+	containers = append([]corev1.Container{{
 		Name:            ProxySidecarContainerName,
 		Image:           strings.Join([]string{imageRepository, ProxyImageVersion}, ":"),
 		ImagePullPolicy: corev1.PullIfNotPresent,
@@ -265,7 +265,7 @@ func (m *podMutator) injectProxySidecarContainer(containers []corev1.Container,
 			ReadOnlyRootFilesystem: pointer.Bool(true),
 			RunAsNonRoot:           pointer.Bool(true),
 		},
-	})
+	}}, containers...)
 
 	return containers
 }
diff --git a/pkg/webhook/webhook_test.go b/pkg/webhook/webhook_test.go
index 2dba3298d..e25f50347 100644
--- a/pkg/webhook/webhook_test.go
+++ b/pkg/webhook/webhook_test.go
@@ -1128,11 +1128,11 @@ func TestInjectProxySidecarContainer(t *testing.T) {
 				},
 			},
 			expectedContainers: []corev1.Container{
+				proxySidecarContainer,
 				{
 					Name:  "my-container",
 					Image: "my-image",
 				},
-				proxySidecarContainer,
 			},
 		},
 	}