diff --git a/templates/backstage-rbac.yaml b/templates/backstage-rbac.yaml
index 7e4b77e..45acb59 100644
--- a/templates/backstage-rbac.yaml
+++ b/templates/backstage-rbac.yaml
@@ -22,6 +22,16 @@ rules:
     resources: ["pods/log"]
     verbs: ["get", "list"]
 
+  # ServiceAccount token creation for kubeconfig generation
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+
+  # Read ServiceAccounts to verify existence
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "list"]
+
   - apiGroups: ["apps"]
     resources: ["deployments", "replicasets"]
     verbs: ["get", "list", "watch"]