diff --git a/build/Dockerfile b/build/Dockerfile
index 303144f4a..f6de72fb3 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -8,7 +8,7 @@ COPY . .
 RUN make go-build
 
 ####
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1782797275
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1786380870
 
 ENV USER_UID=1001 \
     USER_NAME=certman-operator
diff --git a/build/Dockerfile.olm-registry b/build/Dockerfile.olm-registry
index 4a298c49b..85f60aad6 100644
--- a/build/Dockerfile.olm-registry
+++ b/build/Dockerfile.olm-registry
@@ -4,7 +4,7 @@ COPY ${SAAS_OPERATOR_DIR} manifests
 RUN initializer --permissive
 
 # ubi-micro does not work for clusters with fips enabled unless we make OpenSSL available
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1782797275
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1786380870
 
 COPY --from=builder /bin/registry-server /bin/registry-server
 COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe
diff --git a/deploy/role.yaml b/deploy/role.yaml
index e6c8288db..8ec76672c 100644
--- a/deploy/role.yaml
+++ b/deploy/role.yaml
@@ -7,30 +7,23 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
-  - services
-  - endpoints
-  - persistentvolumeclaims
-  - events
-  - configmaps
   - secrets
   verbs:
-  - '*'
+  - get
+  - create
+  - update
 - apiGroups:
   - ""
   resources:
-  - namespaces
+  - configmaps
   verbs:
   - get
 - apiGroups:
-  - apps
+  - ""
   resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
+  - namespaces
   verbs:
-  - '*'
+  - get
 - apiGroups:
   - monitoring.coreos.com
   resources:
diff --git a/deploy_pko/ClusterRole-certman-operator.yaml b/deploy_pko/ClusterRole-certman-operator.yaml
index ecb70311f..9207e05c8 100644
--- a/deploy_pko/ClusterRole-certman-operator.yaml
+++ b/deploy_pko/ClusterRole-certman-operator.yaml
@@ -10,42 +10,23 @@ rules:
 - apiGroups:
   - ''
   resources:
-  - pods
-  - services
-  - endpoints
-  - persistentvolumeclaims
-  - events
-  - configmaps
   - secrets
   verbs:
+  - get
   - create
   - update
-  - patch
-  - delete
-  - get
-  - list
-  - watch
 - apiGroups:
   - ''
   resources:
-  - namespaces
+  - configmaps
   verbs:
   - get
 - apiGroups:
-  - apps
+  - ''
   resources:
-  - deployments
-  - daemonsets
-  - replicasets
-  - statefulsets
+  - namespaces
   verbs:
-  - create
-  - update
-  - patch
-  - delete
   - get
-  - list
-  - watch
 - apiGroups:
   - monitoring.coreos.com
   resources: