diff --git a/templates/backstage-rbac.yaml b/templates/backstage-rbac.yaml
index 45acb59..fc6afc2 100644
--- a/templates/backstage-rbac.yaml
+++ b/templates/backstage-rbac.yaml
@@ -32,6 +32,11 @@ rules:
     resources: ["serviceaccounts"]
     verbs: ["get", "list"]
 
+  # Read secrets for database credential discovery
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+
   - apiGroups: ["apps"]
     resources: ["deployments", "replicasets"]
     verbs: ["get", "list", "watch"]