diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 1cd78792..fe0ea9df 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -1612,7 +1612,7 @@
 # to change thread namespace without having to copy and override the
 # entire change thread namespace rule.
 - list: user_known_change_thread_namespace_binaries
-  items: []
+  items: [crio, multus]
 
 - macro: user_known_change_thread_namespace_activities
   condition: (never_true)