diff --git a/script/helm/garage/templates/clusterrole.yaml b/script/helm/garage/templates/clusterrole.yaml
index 3fb81af9..7f4ac312 100644
--- a/script/helm/garage/templates/clusterrole.yaml
+++ b/script/helm/garage/templates/clusterrole.yaml
@@ -1,3 +1,4 @@
+{{- if eq .Values.garage.noClusterRole false }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -28,3 +29,4 @@ roleRef:
   kind: ClusterRole
   name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }}
   apiGroup: rbac.authorization.k8s.io
+{{ end }}
diff --git a/script/helm/garage/templates/role.yaml b/script/helm/garage/templates/role.yaml
new file mode 100644
index 00000000..6c8618ec
--- /dev/null
+++ b/script/helm/garage/templates/role.yaml
@@ -0,0 +1,27 @@
+{{- if eq .Values.garage.noClusterRole true }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }}
+  labels:
+    {{- include "garage.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["deuxfleurs.fr"]
+  resources: ["garagenodes"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: allow-crds-for-{{ .Release.Namespace }}-{{ .Release.Name }}
+  labels:
+    {{- include "garage.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "garage.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }}
+  apiGroup: rbac.authorization.k8s.io
+{{ end }}
diff --git a/script/helm/garage/values.yaml b/script/helm/garage/values.yaml
index 13e17c74..de44a34f 100644
--- a/script/helm/garage/values.yaml
+++ b/script/helm/garage/values.yaml
@@ -46,6 +46,8 @@ garage:
   # -- Set to true if you want to use k8s discovery but install the CRDs manually outside
   # of the helm chart, for example if you operate at namespace level without cluster resources
   kubernetesSkipCrd: false
+  # -- Set to true if you want to use roles instead of cluster roles
+  noClusterRole: false
   s3:
     api:
       bindAddr: "[::]:3900"