diff --git a/controllers/packagevariantsets/config/rbac/role.yaml b/controllers/packagevariantsets/config/rbac/role.yaml
index 97c213a8..e403fa3f 100644
--- a/controllers/packagevariantsets/config/rbac/role.yaml
+++ b/controllers/packagevariantsets/config/rbac/role.yaml
@@ -61,15 +61,3 @@ rules:
   - get
   - patch
   - update
-- apiGroups:
-  - porch.kpt.dev
-  resources:
-  - packagerevisions
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
\ No newline at end of file
diff --git a/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go b/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go
index 292aa979..4e9753de 100644
--- a/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go
+++ b/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go
@@ -73,6 +73,8 @@ const (
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=packagevariantsets/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=packagevariantsets/finalizers,verbs=update
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=packagevariants,verbs=create;delete;get;list;patch;update;watch
+//+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisions,verbs=create;delete;get;list;patch;update;watch
+//+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisionresources,verbs=create;delete;get;list;patch;update;watch
 //+kubebuilder:rbac:groups=*,resources=*,verbs=list
 
 // Reconcile implements the main kubernetes reconciliation loop.