diff --git a/charts/cert-manager-webhook-pcloud/templates/rbac.yaml b/charts/cert-manager-webhook-pcloud/templates/rbac.yaml
index c3d8405..acd44c1 100644
--- a/charts/cert-manager-webhook-pcloud/templates/rbac.yaml
+++ b/charts/cert-manager-webhook-pcloud/templates/rbac.yaml
@@ -65,7 +65,7 @@
     heritage: {{ .Release.Service }}
 rules:
   - apiGroups:
-      - {{ .Values.groupName }}
+      - {{ .Values.apiGroupName }}
     resources:
       - "*"
     verbs:
@@ -120,6 +120,34 @@
     kind: ServiceAccount
     name: {{ include "cert-manager-webhook-pcloud.fullname" . }}
     namespace: {{ .Values.certManager.namespace | quote }}
+---
+# TODO(gio): limit access by resourceNames
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "cert-manager-webhook-pcloud.fullname" . }}:api-configmap-reader
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - "configmaps"
+    verbs:
+      - "get"
+      - "watch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cert-manager-webhook-pcloud.fullname" . }}:api-configmap-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "cert-manager-webhook-pcloud.fullname" . }}:api-configmap-reader
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: {{ include "cert-manager-webhook-pcloud.fullname" . }}
+    namespace: {{ .Values.certManager.namespace | quote }}
 {{- if .Values.features.apiPriorityAndFairness }}
 ---
 # Grant cert-manager-webhook-pcloud permission to read the flow control mechanism (APF)
@@ -162,4 +190,4 @@
     kind: ServiceAccount
     name: {{ include "cert-manager-webhook-pcloud.fullname" . }}
     namespace: {{ .Values.certManager.namespace | quote }}
-{{- end }}
\ No newline at end of file
+{{- end }}