diff --git a/scripts/g14-gitops-render.mjs b/scripts/g14-gitops-render.mjs
index 94538aee..871c1b9a 100644
--- a/scripts/g14-gitops-render.mjs
+++ b/scripts/g14-gitops-render.mjs
@@ -790,6 +790,21 @@ function tektonRbac() {
     items: [
       { apiVersion: "v1", kind: "Namespace", metadata: { name: "hwlab-ci" } },
       { apiVersion: "v1", kind: "ServiceAccount", metadata: { name: "hwlab-tekton-runner", namespace: "hwlab-ci" } },
+      {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata: { name: "hwlab-g14-control-plane-reconciler", namespace: "hwlab-dev" },
+        rules: [
+          { apiGroups: ["rbac.authorization.k8s.io"], resources: ["roles", "rolebindings"], verbs: ["get", "patch", "create"] }
+        ]
+      },
+      {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata: { name: "hwlab-g14-control-plane-reconciler", namespace: "hwlab-dev" },
+        subjects: [{ kind: "ServiceAccount", name: "hwlab-tekton-runner", namespace: "hwlab-ci" }],
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: "hwlab-g14-control-plane-reconciler" }
+      },
       {
         apiVersion: "rbac.authorization.k8s.io/v1",
         kind: "Role",
@@ -813,10 +828,10 @@ function tektonRbac() {
         metadata: { name: "hwlab-tekton-pipelinerun-writer", namespace: "hwlab-ci" },
         rules: [
           { apiGroups: ["tekton.dev"], resources: ["pipelineruns"], verbs: ["get", "list", "create"] },
-          { apiGroups: ["tekton.dev"], resources: ["pipelines"], verbs: ["get", "patch"] },
-          { apiGroups: ["batch"], resources: ["cronjobs"], verbs: ["get", "patch"] },
-          { apiGroups: ["rbac.authorization.k8s.io"], resources: ["roles", "rolebindings"], verbs: ["get", "patch"] },
-          { apiGroups: [""], resources: ["serviceaccounts"], verbs: ["get", "patch"] }
+          { apiGroups: ["tekton.dev"], resources: ["pipelines"], verbs: ["get", "patch", "create"] },
+          { apiGroups: ["batch"], resources: ["cronjobs"], verbs: ["get", "patch", "create"] },
+          { apiGroups: ["rbac.authorization.k8s.io"], resources: ["roles", "rolebindings"], verbs: ["get", "patch", "create"] },
+          { apiGroups: [""], resources: ["serviceaccounts"], verbs: ["get", "patch", "create"] }
         ]
       },
       {