diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 6e8dd4b..14770ef 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -30,6 +30,7 @@ rules:
   - list
   - patch
   - update
+  - watch
 - apiGroups:
   - domain.mailgun.com
   resources:
diff --git a/internal/controller/domain/domain_controller.go b/internal/controller/domain/domain_controller.go
index c73819d..bcac51a 100644
--- a/internal/controller/domain/domain_controller.go
+++ b/internal/controller/domain/domain_controller.go
@@ -57,7 +57,7 @@ type DomainReconciler struct {
 // +kubebuilder:rbac:groups=domain.mailgun.com,resources=domains/finalizers,verbs=update
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
 // +kubebuilder:rbac:groups=externaldns.k8s.io,resources=dnsendpoints,verbs=get;list;create;update;patch;delete;watch
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.