diff --git a/runtime-nodejs/kustomize-with-rbac/kustomization.yaml b/runtime-nodejs/kustomize-with-rbac/kustomization.yaml
new file mode 100644
index 0000000..bc6a33e
--- /dev/null
+++ b/runtime-nodejs/kustomize-with-rbac/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../rbac-readonly
+- ../kustomize
+patchesStrategicMerge:
+- specs-serviceaccount.yaml
diff --git a/runtime-nodejs/kustomize-with-rbac/specs-serviceaccount.yaml b/runtime-nodejs/kustomize-with-rbac/specs-serviceaccount.yaml
new file mode 100644
index 0000000..55952d1
--- /dev/null
+++ b/runtime-nodejs/kustomize-with-rbac/specs-serviceaccount.yaml
@@ -0,0 +1,8 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: specs
+spec:
+  template:
+    spec:
+      serviceAccountName: assert
diff --git a/runtime-nodejs/kustomize/kustomization.yaml b/runtime-nodejs/kustomize/kustomization.yaml
index a6162d1..d3e8f9f 100644
--- a/runtime-nodejs/kustomize/kustomization.yaml
+++ b/runtime-nodejs/kustomize/kustomization.yaml
@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-bases:
-- ../rbac-readonly
 resources:
 - scrapeable-deployment.yaml
 # TODO if many tests reuse this base, how do we manage podmonitor?
diff --git a/runtime-nodejs/kustomize/scrapeable-deployment.yaml b/runtime-nodejs/kustomize/scrapeable-deployment.yaml
index f01139e..6878aba 100644
--- a/runtime-nodejs/kustomize/scrapeable-deployment.yaml
+++ b/runtime-nodejs/kustomize/scrapeable-deployment.yaml
@@ -12,7 +12,6 @@ spec:
       labels:
         kubernetes-assert: metrics
     spec:
-      serviceAccountName: assert
       containers:
       - name: specs
         # We can't have a tag here because https://kubectl.docs.kubernetes.io/pages/reference/kustomize.html#images won't unset it, and Skaffold required no-tag URLs for build