diff --git a/infrastructure/cert-manager/webhook-rbac.yaml b/infrastructure/cert-manager/webhook-rbac.yaml
new file mode 100644
index 0000000..6ffff1f
--- /dev/null
+++ b/infrastructure/cert-manager/webhook-rbac.yaml
@@ -0,0 +1,25 @@
+# infrastructure/cert-manager/webhook-rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cert-manager-webhook-duckdns-token-reader
+  namespace: cert-manager
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["duckdns-token"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cert-manager-webhook-duckdns-token-reader
+  namespace: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cert-manager-webhook-duckdns-token-reader
+subjects:
+- kind: ServiceAccount
+  name: cert-manager-webhook-duckdns
+  namespace: cert-manager
\ No newline at end of file