diff --git a/control-plane/config/sink/100-webhook-cluster-role.yaml b/control-plane/config/sink/100-webhook-cluster-role.yaml
index d827054c0f..6edd095cdc 100644
--- a/control-plane/config/sink/100-webhook-cluster-role.yaml
+++ b/control-plane/config/sink/100-webhook-cluster-role.yaml
@@ -81,3 +81,12 @@ rules:
     resources:
       - "leases"
     verbs: *everything
+
+  # finalizers are needed for the owner reference of the webhook
+  - apiGroups:
+      - ""
+    resources:
+      - "namespaces/finalizers"
+    verbs:
+      - "update"
+