diff --git a/charts/ferrvault-operator/README.md b/charts/ferrvault-operator/README.md
index 2499004..a3af32b 100644
--- a/charts/ferrvault-operator/README.md
+++ b/charts/ferrvault-operator/README.md
@@ -49,7 +49,7 @@ kubectl delete crd ferrvaultsecrets.ferrvault.com ferrvaultconnections.ferrvault
 | `replicaCount` | `1` | Raise when using leader election for HA. |
 | `leaderElection.enabled` | `true` | |
 | `leaderElection.id` | `ferrvault-operator.ferrvault.com` | Change to run multiple isolated instances in one cluster. |
-| `watchNamespace` | `""` (cluster-wide) | Single namespace scope when set. |
+| `watchNamespace` | `""` (cluster-wide) | Single namespace scope when set. RBAC is then a namespaced `Role` and `RoleBinding` in that namespace instead of a `ClusterRole`. |
 | `defaultRefreshInterval` | `1h` | Fallback for `FerrVaultSecret.spec.refreshInterval`. |
 | `stallThreshold` | `15m` | Liveness fails when no reconcile completes for this long while FerrVault resources exist. Keep it above the 10m connection probe interval. |
 | `reconcileTimeout` | `2m` | A single reconcile is cancelled after this long, so one call that never returns cannot hold the work queue. The operator refuses to start below about 31s, the longest one FerrVault API call can take with its three 10s attempts and backoff. |
diff --git a/charts/ferrvault-operator/templates/_helpers.tpl b/charts/ferrvault-operator/templates/_helpers.tpl
index a079567..fa037f0 100644
--- a/charts/ferrvault-operator/templates/_helpers.tpl
+++ b/charts/ferrvault-operator/templates/_helpers.tpl
@@ -71,3 +71,30 @@ with the chart version released together.
 {{- define "ferrvault-operator.imageTag" -}}
 {{- default .Chart.AppVersion .Values.image.tag }}
 {{- end }}
+
+{{- define "ferrvault-operator.rules" -}}
+- apiGroups: ["ferrvault.com"]
+  resources: [ferrvaultsecrets, ferrvaultconnections]
+  verbs: [get, list, watch, create, update, patch, delete]
+- apiGroups: ["ferrvault.com"]
+  resources: [ferrvaultsecrets/status, ferrvaultconnections/status]
+  verbs: [get, update, patch]
+- apiGroups: ["ferrvault.com"]
+  resources: [ferrvaultsecrets/finalizers, ferrvaultconnections/finalizers]
+  verbs: [update]
+- apiGroups: [apps]
+  resources: [deployments, statefulsets, daemonsets]
+  verbs: [get, patch]
+- apiGroups: [""]
+  resources: [secrets]
+  verbs: [get, list, watch, create, update, patch]
+- apiGroups: [""]
+  resources: [events]
+  verbs: [create, patch]
+{{- end }}
+
+{{- define "ferrvault-operator.leaseRules" -}}
+- apiGroups: ["coordination.k8s.io"]
+  resources: [leases]
+  verbs: [get, list, watch, create, update, patch, delete]
+{{- end }}
diff --git a/charts/ferrvault-operator/templates/clusterrole.yaml b/charts/ferrvault-operator/templates/clusterrole.yaml
index 1130485..a741265 100644
--- a/charts/ferrvault-operator/templates/clusterrole.yaml
+++ b/charts/ferrvault-operator/templates/clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create -}}
+{{- if and .Values.rbac.create (not .Values.watchNamespace) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -6,36 +6,8 @@ metadata:
   labels:
     {{- include "ferrvault-operator.labels" . | nindent 4 }}
 rules:
-  # Full CR access for the operator's own types.
-  - apiGroups: ["ferrvault.com"]
-    resources: [ferrvaultsecrets, ferrvaultconnections]
-    verbs: [get, list, watch, create, update, patch, delete]
-  - apiGroups: ["ferrvault.com"]
-    resources: [ferrvaultsecrets/status, ferrvaultconnections/status]
-    verbs: [get, update, patch]
-  - apiGroups: ["ferrvault.com"]
-    resources: [ferrvaultsecrets/finalizers, ferrvaultconnections/finalizers]
-    verbs: [update]
-
-  - apiGroups: [apps]
-    resources: [deployments, statefulsets, daemonsets]
-    verbs: [get, patch]
-
-  # Manages the target Secret and reads the referenced token Secret.
-  - apiGroups: [""]
-    resources: [secrets]
-    verbs: [get, list, watch, create, update, patch]
-
-  # Emits Events that show up on `kubectl describe ferrvaultsecret …`.
-  - apiGroups: [""]
-    resources: [events]
-    verbs: [create, patch]
-
+  {{- include "ferrvault-operator.rules" . | nindent 2 }}
   {{- if .Values.leaderElection.enabled }}
-  # Leader election lease. Scoped to the release namespace; the operator does
-  # not need cluster-wide lease access when it owns one specific lease name.
-  - apiGroups: ["coordination.k8s.io"]
-    resources: [leases]
-    verbs: [get, list, watch, create, update, patch, delete]
+  {{- include "ferrvault-operator.leaseRules" . | nindent 2 }}
   {{- end }}
 {{- end }}
diff --git a/charts/ferrvault-operator/templates/clusterrolebinding.yaml b/charts/ferrvault-operator/templates/clusterrolebinding.yaml
index 7bf7799..2bcf664 100644
--- a/charts/ferrvault-operator/templates/clusterrolebinding.yaml
+++ b/charts/ferrvault-operator/templates/clusterrolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create -}}
+{{- if and .Values.rbac.create (not .Values.watchNamespace) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
diff --git a/charts/ferrvault-operator/templates/role.yaml b/charts/ferrvault-operator/templates/role.yaml
new file mode 100644
index 0000000..8c9e021
--- /dev/null
+++ b/charts/ferrvault-operator/templates/role.yaml
@@ -0,0 +1,61 @@
+{{- if and .Values.rbac.create .Values.watchNamespace -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}
+  namespace: {{ .Values.watchNamespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+rules:
+  {{- include "ferrvault-operator.rules" . | nindent 2 }}
+  {{- if and .Values.leaderElection.enabled (eq .Values.watchNamespace .Release.Namespace) }}
+  {{- include "ferrvault-operator.leaseRules" . | nindent 2 }}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}
+  namespace: {{ .Values.watchNamespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "ferrvault-operator.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "ferrvault-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- if and .Values.leaderElection.enabled (ne .Values.watchNamespace .Release.Namespace) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}-leader-election
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+rules:
+  {{- include "ferrvault-operator.leaseRules" . | nindent 2 }}
+  - apiGroups: [""]
+    resources: [events]
+    verbs: [create, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}-leader-election
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "ferrvault-operator.fullname" . }}-leader-election
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "ferrvault-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}
diff --git a/charts/ferrvault-operator/values.yaml b/charts/ferrvault-operator/values.yaml
index 2ca27b6..037bbd0 100644
--- a/charts/ferrvault-operator/values.yaml
+++ b/charts/ferrvault-operator/values.yaml
@@ -23,7 +23,7 @@ leaderElection:
 
 # --- Scope ---
 # Empty string = cluster-wide (operator watches every namespace). Set to a
-# namespace name to restrict the informer cache to a single namespace.
+# namespace name to restrict the informer cache and the RBAC to a single namespace.
 watchNamespace: ""
 
 # --- Runtime flags ---