diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 19a4ea9ba..c233a4a51 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -661,6 +661,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ovn.openstack.org
   resources:
diff --git a/controllers/dataplane/openstackdataplanenodeset_controller.go b/controllers/dataplane/openstackdataplanenodeset_controller.go
index 404f7776d..2e11f1890 100644
--- a/controllers/dataplane/openstackdataplanenodeset_controller.go
+++ b/controllers/dataplane/openstackdataplanenodeset_controller.go
@@ -123,7 +123,7 @@ func (r *OpenStackDataPlaneNodeSetReconciler) GetLogger(ctx context.Context) log
 // +kubebuilder:rbac:groups="image.openshift.io",resources=imagestreamtags,verbs=get;list;watch
 
 // RBAC for ImageContentSourcePolicy and MachineConfig
-// +kubebuilder:rbac:groups="operator.openshift.io",resources=imagecontentsourcepolicies,verbs=get;list
+// +kubebuilder:rbac:groups="operator.openshift.io",resources=imagecontentsourcepolicies,verbs=get;list;watch
 // +kubebuilder:rbac:groups="machineconfiguration.openshift.io",resources=machineconfigs,verbs=get;list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to