diff --git a/infra/k8s/argo/ci-deploy-rbac.yaml b/infra/k8s/argo/ci-deploy-rbac.yaml
index 5aff8cef5..c41ac8ac5 100644
--- a/infra/k8s/argo/ci-deploy-rbac.yaml
+++ b/infra/k8s/argo/ci-deploy-rbac.yaml
@@ -7,18 +7,25 @@ metadata:
   labels:
     app.kubernetes.io/part-of: foxhunt
 rules:
+  # apps: roll + apply Deployments. watch is required by `kubectl rollout status`.
   - apiGroups: ["apps"]
     resources: [deployments]
-    verbs: [get, list, patch]
+    verbs: [get, list, watch, patch]
   - apiGroups: ["argoproj.io"]
     resources: [workflowtemplates, eventsources, sensors, eventbus]
     verbs: [get, list, create, update, patch]
+  # core: services/configmaps, plus serviceaccounts (tailscale-dashboard, dagster) and the forward-track PVC
+  # — added so the fxhnt-cockpit deploy can `kubectl apply` its full manifest set without a partial-apply failure.
   - apiGroups: [""]
-    resources: [services, configmaps]
+    resources: [services, configmaps, serviceaccounts, persistentvolumeclaims]
     verbs: [get, list, create, update, patch]
   - apiGroups: ["networking.k8s.io"]
     resources: [networkpolicies]
     verbs: [get, list, create, update, patch]
+  # batch: the fxhnt-forward CronJob
+  - apiGroups: ["batch"]
+    resources: [cronjobs]
+    verbs: [get, list, create, update, patch]
   - apiGroups: ["rbac.authorization.k8s.io"]
     resources: [roles, rolebindings]
     verbs: [get, list, create, update, patch, bind, escalate]