diff --git a/charts/operator/Chart.yaml b/charts/operator/Chart.yaml
index 1cdbe9cc..b4903768 100644
--- a/charts/operator/Chart.yaml
+++ b/charts/operator/Chart.yaml
@@ -3,8 +3,11 @@ name: azimuth-caas-operator
 description: Helm chart for deploying the Azimuth Cluster-as-a-Service operator.
 type: application
 # The version and appVersion are set by the CI script
-version: 0.1.0
+version: 0.1.1
 appVersion: "main"
+maintainers:
+  - name: azimuth-cloud
+    url: https://github.com/azimuth-cloud
 
 dependencies:
   - name: ara
diff --git a/charts/operator/templates/clusterrole-operator.yaml b/charts/operator/templates/clusterrole-operator.yaml
index c6af05f9..a8af3ecd 100644
--- a/charts/operator/templates/clusterrole-operator.yaml
+++ b/charts/operator/templates/clusterrole-operator.yaml
@@ -4,10 +4,17 @@ metadata:
   name: {{ include "azimuth-caas-operator.fullname" . }}:controller
   labels: {{ include "azimuth-caas-operator.labels" . | nindent 4 }}
 rules:
-  # Required by kopf
+  # Required by kopf — list/watch cannot be scoped with resourceNames (collection ops)
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["*"]
+    verbs: ["list", "watch"]
+  # Write access restricted to the CRDs this operator owns
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    resourceNames:
+      - clusters.caas.azimuth.stackhpc.com
+      - clustertypes.caas.azimuth.stackhpc.com
+    verbs: ["get", "create", "update", "patch"]
   - apiGroups: [""]
     resources: ["namespaces"]
     verbs: ["list", "watch"]
diff --git a/charts/operator/tests/__snapshot__/snapshot_test.yaml.snap b/charts/operator/tests/__snapshot__/snapshot_test.yaml.snap
index 7f35c704..a4fb37ad 100644
--- a/charts/operator/tests/__snapshot__/snapshot_test.yaml.snap
+++ b/charts/operator/tests/__snapshot__/snapshot_test.yaml.snap
@@ -121,7 +121,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
         rbac.authorization.k8s.io/aggregate-to-admin: "true"
         rbac.authorization.k8s.io/aggregate-to-edit: "true"
         rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -142,7 +142,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator:controller
     rules:
       - apiGroups:
@@ -150,7 +150,20 @@ templated manifests should match snapshot:
         resources:
           - customresourcedefinitions
         verbs:
-          - '*'
+          - list
+          - watch
+      - apiGroups:
+          - apiextensions.k8s.io
+        resourceNames:
+          - clusters.caas.azimuth.stackhpc.com
+          - clustertypes.caas.azimuth.stackhpc.com
+        resources:
+          - customresourcedefinitions
+        verbs:
+          - get
+          - create
+          - update
+          - patch
       - apiGroups:
           - ""
         resources:
@@ -234,7 +247,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator:tfstate
     rules:
       - apiGroups:
@@ -263,7 +276,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
         rbac.authorization.k8s.io/aggregate-to-view: "true"
       name: release-name-azimuth-caas-operator:view
     rules:
@@ -284,7 +297,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator
     roleRef:
       apiGroup: rbac.authorization.k8s.io
@@ -303,7 +316,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator
     spec:
       replicas: 1
@@ -369,7 +382,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator-extravars
     stringData:
       extravars: |
@@ -383,7 +396,7 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator
     spec:
       ports:
@@ -404,5 +417,5 @@ templated manifests should match snapshot:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: azimuth-caas-operator
         app.kubernetes.io/version: main
-        helm.sh/chart: azimuth-caas-operator-0.1.0
+        helm.sh/chart: azimuth-caas-operator-0.1.1
       name: release-name-azimuth-caas-operator