diff --git a/config/core/roles/webhook-clusterrole.yaml b/config/core/roles/webhook-clusterrole.yaml
index 68c45c3995d..92d30b4939e 100644
--- a/config/core/roles/webhook-clusterrole.yaml
+++ b/config/core/roles/webhook-clusterrole.yaml
@@ -42,6 +42,14 @@ rules:
       - "watch"
       - "patch"
 
+  # finalizers are needed for the owner reference of the webhook
+  - apiGroups:
+      - ""
+    resources:
+      - "namespaces/finalizers"
+    verbs:
+      - "update"
+
   # For getting our Deployment so we can decorate with ownerref.
   - apiGroups:
       - "apps"