diff --git a/templates/backstage-rbac.yaml b/templates/backstage-rbac.yaml
index fc6afc2..227ff24 100644
--- a/templates/backstage-rbac.yaml
+++ b/templates/backstage-rbac.yaml
@@ -22,15 +22,17 @@ rules:
     resources: ["pods/log"]
     verbs: ["get", "list"]
 
-  # ServiceAccount token creation for kubeconfig generation
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    verbs: ["create"]
-
-  # Read ServiceAccounts to verify existence
-  - apiGroups: [""]
-    resources: ["serviceaccounts"]
-    verbs: ["get", "list"]
+  # CSR creation and approval for kubeconfig generation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests/approval"]
+    verbs: ["update"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["kubernetes.io/kube-apiserver-client"]
+    verbs: ["approve"]
 
   # Read secrets for database credential discovery
   - apiGroups: [""]
diff --git a/values.yaml b/values.yaml
index 5422318..e1acca2 100644
--- a/values.yaml
+++ b/values.yaml
@@ -6,7 +6,7 @@ namespaceOverride: "backstage"
 # Backstage application image
 image:
   repository: gcr.io/prj-onlinesales-test-framework/backstage
-  tag: "main-8d37954"
+  tag: "main-bfb547c"
   pullPolicy: IfNotPresent
 
 # Replica count