diff --git a/CODEOWNERS b/CODEOWNERS
index c927a32f..bea7f2c1 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1,7 +1,20 @@
-# Default owners for everything
-* @rossoctl/moca-maintainers
+# Code owners for rossoctl/moca.
+#
+# Owners here are DERIVED from the project's source of truth for maintainership:
+#   https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md
+#
+# CODEOWNERS cannot reference that file, or any file: GitHub accepts only user and team
+# handles, and it is read only from this repository's root, .github/ or docs/ -- there is no
+# inheritance from rossoctl/rossoctl to lean on. So these names are a copy, and they have to
+# be updated when MAINTAINERS.md changes.
+#
+# A rule naming a user or team that does not exist, or that lacks write access here, is
+# silently ignored -- the matched paths end up with no owner and no warning. If you edit this
+# file, confirm every handle still has access.
 
-# CI and deployment
-.github/ @kagenti/platform
-deploy/ @kagenti/platform
-Dockerfile @kagenti/platform
+# Default owner. Per MAINTAINERS.md: Serverless Harness, Agent Sandboxing, microVM sandbox
+# density experiments, Helm & Installer -- which is this repository.
+* @pdettori
+
+# Deployment paths. Jarek owns Agent Lifecycle Management and sandbox CRDs & warm pools.
+deploy/ @pdettori @cwiklik