diff --git a/charts/tailscale/templates/install.yaml b/charts/tailscale/templates/install.yaml
index 6227c7e..78b3704 100644
--- a/charts/tailscale/templates/install.yaml
+++ b/charts/tailscale/templates/install.yaml
@@ -70,3 +70,27 @@
         # volumeMounts:
         # - name: tailscale
         #   mountPath: /tailscale-state
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secrets
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "watch", "list", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secrets
+  namespace: {{ .Release.Namespace }}
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: secrets
+  apiGroup: rbac.authorization.k8s.io