diff --git a/services/comms/mas-secrets-ensure-rbac.yaml b/services/comms/mas-secrets-ensure-rbac.yaml
index 11f59c3..22ff987 100644
--- a/services/comms/mas-secrets-ensure-rbac.yaml
+++ b/services/comms/mas-secrets-ensure-rbac.yaml
@@ -1,26 +1,20 @@
 # services/comms/mas-secrets-ensure-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: mas-secrets-ensure
-  namespace: comms
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["mas-secrets-runtime"]
-    verbs: ["get", "patch", "update"]
+    verbs: ["get", "create", "patch", "update"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   name: mas-secrets-ensure
-  namespace: comms
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: mas-secrets-ensure
 subjects:
   - kind: ServiceAccount