diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1e3fa84..dd514782 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
-- Document Helm deployed RBAC permissions and remove unnecessary permissions ([#380]).
+- Document Helm deployed RBAC permissions and remove unnecessary permissions ([#380], [#397]).
 
 ### Fixed
 
@@ -14,6 +14,7 @@ All notable changes to this project will be documented in this file.
 
 [#380]: https://github.com/stackabletech/listener-operator/pull/380
 [#393]: https://github.com/stackabletech/listener-operator/pull/393
+[#397]: https://github.com/stackabletech/listener-operator/pull/397
 
 ## [26.3.0] - 2026-03-16
 
diff --git a/deploy/helm/listener-operator/templates/roles.yaml b/deploy/helm/listener-operator/templates/roles.yaml
index 23aee317..9c5ebe57 100644
--- a/deploy/helm/listener-operator/templates/roles.yaml
+++ b/deploy/helm/listener-operator/templates/roles.yaml
@@ -61,6 +61,9 @@ rules:
       - get
       - list
       - watch
+      - create
+      - update
+      - patch
   # Service created per Listener. Applied via SSA and tracked for orphan cleanup.
   - apiGroups:
       - ""