diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 503f390..00c1421 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -29,14 +29,6 @@ rules:
   - impersonate
   - list
   - watch
-- apiGroups:
-  - apiextensions.k8s.io
-  resources:
-  - customresourcedefinitions
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - templates.kluctl.io
   resources:
diff --git a/controllers/objecttemplate_controller.go b/controllers/objecttemplate_controller.go
index 5f375b8..0678b21 100644
--- a/controllers/objecttemplate_controller.go
+++ b/controllers/objecttemplate_controller.go
@@ -49,7 +49,6 @@ type ObjectTemplateReconciler struct {
 //+kubebuilder:rbac:groups=templates.kluctl.io,resources=objecttemplates,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=templates.kluctl.io,resources=objecttemplates/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=templates.kluctl.io,resources=objecttemplates/finalizers,verbs=update
-//+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
 //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;impersonate
 
 // Reconcile a resource