diff --git a/infra/k8s/services/api-gateway.yaml b/infra/k8s/services/api-gateway.yaml
index 7c21bf5aa..96b7ad295 100644
--- a/infra/k8s/services/api-gateway.yaml
+++ b/infra/k8s/services/api-gateway.yaml
@@ -26,6 +26,7 @@ spec:
         app.kubernetes.io/name: api-gateway
         app.kubernetes.io/part-of: foxhunt
     spec:
+      serviceAccountName: api-gateway
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
@@ -145,3 +146,39 @@ spec:
     - port: 9091
       targetPort: 9091
       name: metrics
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: api-gateway
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: api-gateway
+    app.kubernetes.io/part-of: foxhunt
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: api-gateway-pod-reader
+  namespace: foxhunt
+rules:
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get, list, watch]
+  - apiGroups: [metrics.k8s.io]
+    resources: [pods]
+    verbs: [get, list]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: api-gateway-pod-reader
+  namespace: foxhunt
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: api-gateway-pod-reader
+subjects:
+  - kind: ServiceAccount
+    name: api-gateway
+    namespace: foxhunt