diff --git a/packages/system/backup-controller/templates/rbac.yaml b/packages/system/backup-controller/templates/rbac.yaml
index 255398e8..37ab7243 100644
--- a/packages/system/backup-controller/templates/rbac.yaml
+++ b/packages/system/backup-controller/templates/rbac.yaml
@@ -3,30 +3,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: backups.cozystack.io:core-controller
 rules:
+# Plan: reconcile schedule and update status
 - apiGroups: ["backups.cozystack.io"]
   resources: ["plans"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["backups.cozystack.io"]
-  resources: ["backupjobs"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
-- apiGroups: ["backups.cozystack.io"]
-  resources: ["backupjobs/status"]
+  resources: ["plans/status"]
   verbs: ["get", "update", "patch"]
+# BackupJob: create when schedule fires (status is updated by backupstrategy-controller)
 - apiGroups: ["backups.cozystack.io"]
-  resources: ["backups"]
+  resources: ["backupjobs"]
   verbs: ["create", "get", "list", "watch"]
-- apiGroups: ["apps.cozystack.io"]
-  resources: ["buckets", "bucketaccesses", "virtualmachines"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["objectstorage.k8s.io"]
-  resources: ["buckets", "bucketaccesses"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
-- apiGroups: ["kubevirt.io"]
-  resources: ["virtualmachines"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["velero.io"]
-  resources: ["backups", "backupstoragelocations", "volumesnapshotlocations", "restores"]
-  verbs: ["create", "get", "list", "watch", "update", "patch"]
diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml
index 85431a4b..b69a2744 100644
--- a/packages/system/backupstrategy-controller/templates/rbac.yaml
+++ b/packages/system/backupstrategy-controller/templates/rbac.yaml
@@ -3,9 +3,34 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: backups.cozystack.io:strategy-controller
 rules:
+# Strategy types (Velero, Job)
 - apiGroups: ["strategy.backups.cozystack.io"]
   resources: ["*"]
   verbs: ["get", "list", "watch"]
+# BackupClass: resolve strategy per application
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backupclasses"]
+  verbs: ["get", "list", "watch"]
+# BackupJob / RestoreJob: reconcile and update status
 - apiGroups: ["backups.cozystack.io"]
   resources: ["backupjobs", "restorejobs"]
   verbs: ["get", "list", "watch"]
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backupjobs/status", "restorejobs/status"]
+  verbs: ["get", "update", "patch"]
+# Backup: create after Velero backup completes
+- apiGroups: ["backups.cozystack.io"]
+  resources: ["backups"]
+  verbs: ["create", "get", "list", "watch"]
+# Application refs (e.g. VMInstance, VirtualMachine) for backup/restore scope
+- apiGroups: ["apps.cozystack.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+# Velero Backup/Restore in cozy-velero namespace
+- apiGroups: ["velero.io"]
+  resources: ["backups", "restores"]
+  verbs: ["create", "get", "list", "watch", "update", "patch"]
+# Leader election (--leader-elect)
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]