diff --git a/controllers/packagevariants/config/rbac/role.yaml b/controllers/packagevariants/config/rbac/role.yaml
index feede573..10e513d3 100644
--- a/controllers/packagevariants/config/rbac/role.yaml
+++ b/controllers/packagevariants/config/rbac/role.yaml
@@ -43,6 +43,14 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - config.porch.kpt.dev
+  resources:
+  - repositories
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - porch.kpt.dev
   resources:
diff --git a/controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller.go b/controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller.go
index d2f1c8cf..b20aaabb 100644
--- a/controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller.go
+++ b/controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller.go
@@ -70,6 +70,7 @@ const (
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=packagevariants/finalizers,verbs=update
 //+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisions,verbs=create;delete;get;list;patch;update;watch
 //+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisionresources,verbs=create;delete;get;list;patch;update;watch
+//+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=repositories,verbs=get;list;watch
 
 // Reconcile implements the main kubernetes reconciliation loop.
 func (r *PackageVariantReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
diff --git a/controllers/packagevariantsets/config/rbac/role.yaml b/controllers/packagevariantsets/config/rbac/role.yaml
index e403fa3f..03bb45bb 100644
--- a/controllers/packagevariantsets/config/rbac/role.yaml
+++ b/controllers/packagevariantsets/config/rbac/role.yaml
@@ -61,3 +61,11 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - config.porch.kpt.dev
+  resources:
+  - repositories
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go b/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go
index 292aa979..a02d7823 100644
--- a/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go
+++ b/controllers/packagevariantsets/pkg/controllers/packagevariantset/packagevariantset_controller.go
@@ -74,6 +74,7 @@ const (
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=packagevariantsets/finalizers,verbs=update
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=packagevariants,verbs=create;delete;get;list;patch;update;watch
 //+kubebuilder:rbac:groups=*,resources=*,verbs=list
+//+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=repositories,verbs=get;list;watch
 
 // Reconcile implements the main kubernetes reconciliation loop.
 func (r *PackageVariantSetReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {