diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 7a6f0004..fd1e8b98 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -174,6 +174,17 @@ rules:
   - securitypolicies/finalizers
   verbs:
   - update
+- apiGroups:
+  - gateway.envoyproxy.io
+  resources:
+  - backends/status
+  - backendtrafficpolicies/status
+  - httproutefilters/status
+  - securitypolicies/status
+  verbs:
+  - get
+  - patch
+  - update
 - apiGroups:
   - gateway.networking.k8s.io
   resources:
diff --git a/internal/controller/gateway_resource_replicator_controller.go b/internal/controller/gateway_resource_replicator_controller.go
index 7e949232..c7a48415 100644
--- a/internal/controller/gateway_resource_replicator_controller.go
+++ b/internal/controller/gateway_resource_replicator_controller.go
@@ -56,8 +56,9 @@ const gatewayResourceReplicatorFinalizer = "gateway.networking.datumapis.com/gat
 // resource (including TrafficProtectionPolicy/HTTPProxy/Connector). See config.go
 // SetDefaults_GatewayResourceReplicatorConfig.
 // +kubebuilder:rbac:groups="",resources=configmaps;secrets,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends;backendtrafficpolicies;securitypolicies,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends;backendtrafficpolicies;httproutefilters;securitypolicies,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends/finalizers;backendtrafficpolicies/finalizers;securitypolicies/finalizers,verbs=update
+// +kubebuilder:rbac:groups=gateway.envoyproxy.io,resources=backends/status;backendtrafficpolicies/status;httproutefilters/status;securitypolicies/status,verbs=get;update;patch
 
 type statusTransformFunc func(ctx context.Context, upstreamNamespace string, controllerName string, status map[string]any) (map[string]any, error)