diff --git a/kagenti-operator/config/rbac/role.yaml b/kagenti-operator/config/rbac/role.yaml
index 816fce8..6e0aaf1 100644
--- a/kagenti-operator/config/rbac/role.yaml
+++ b/kagenti-operator/config/rbac/role.yaml
@@ -70,6 +70,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments/finalizers
+  - statefulsets/finalizers
+  verbs:
+  - update
 - apiGroups:
   - networking.k8s.io
   resources:
diff --git a/kagenti-operator/internal/controller/agentcardsync_controller.go b/kagenti-operator/internal/controller/agentcardsync_controller.go
index 70c1722..4de8231 100644
--- a/kagenti-operator/internal/controller/agentcardsync_controller.go
+++ b/kagenti-operator/internal/controller/agentcardsync_controller.go
@@ -52,7 +52,9 @@ type AgentCardSyncReconciler struct {
 
 // +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentcards,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch
+// +kubebuilder:rbac:groups=apps,resources=deployments/finalizers,verbs=update
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch
+// +kubebuilder:rbac:groups=apps,resources=statefulsets/finalizers,verbs=update
 
 func (r *AgentCardSyncReconciler) ReconcileDeployment(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	syncLogger.V(1).Info("Reconciling Deployment for auto-sync", "namespacedName", req.NamespacedName)