diff --git a/config/base/rbac/role.yaml b/config/base/rbac/role.yaml
index d8926918ac..47c22a3777 100644
--- a/config/base/rbac/role.yaml
+++ b/config/base/rbac/role.yaml
@@ -74,4 +74,5 @@ rules:
   verbs:
   - get
   - list
+  - update
   - watch
diff --git a/config/render/capm3.yaml b/config/render/capm3.yaml
index 99e1adf256..558babbe56 100644
--- a/config/render/capm3.yaml
+++ b/config/render/capm3.yaml
@@ -2431,6 +2431,7 @@ rules:
   verbs:
   - get
   - list
+  - update
   - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/controllers/metal3.io/baremetalhost_controller.go b/controllers/metal3.io/baremetalhost_controller.go
index 927bce6356..c264980acd 100644
--- a/controllers/metal3.io/baremetalhost_controller.go
+++ b/controllers/metal3.io/baremetalhost_controller.go
@@ -103,7 +103,7 @@ func (info *reconcileInfo) publishEvent(reason, message string) {
 // +kubebuilder:rbac:groups=metal3.io,resources=dataimages/status,verbs=get;update;patch
 
 // Allow for updating hostupdatepolicies
-//+kubebuilder:rbac:groups=metal3.io,resources=hostupdatepolicies,verbs=get;list;watch
+//+kubebuilder:rbac:groups=metal3.io,resources=hostupdatepolicies,verbs=get;list;watch;update
 
 // Reconcile handles changes to BareMetalHost resources.
 func (r *BareMetalHostReconciler) Reconcile(ctx context.Context, request ctrl.Request) (result ctrl.Result, err error) {