diff --git a/components/manifests/base/rbac/control-plane-clusterrole.yaml b/components/manifests/base/rbac/control-plane-clusterrole.yaml
index c2cec298e..6b54117e9 100644
--- a/components/manifests/base/rbac/control-plane-clusterrole.yaml
+++ b/components/manifests/base/rbac/control-plane-clusterrole.yaml
@@ -16,7 +16,7 @@ rules:
   verbs: ["get", "list", "watch", "create", "update", "patch"]
 # RoleBindings (reconcile group access from ProjectSettings)
 - apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["rolebindings"]
+  resources: ["roles", "rolebindings"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 # Session runner resources (provision/deprovision per-session workloads in project namespaces)
 - apiGroups: [""]