diff --git a/config/crd/bases/conventions.carto.run_clusterpodconventions.yaml b/config/crd/bases/conventions.carto.run_clusterpodconventions.yaml
index 1d1b7362..d0360f7f 100644
--- a/config/crd/bases/conventions.carto.run_clusterpodconventions.yaml
+++ b/config/crd/bases/conventions.carto.run_clusterpodconventions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.16.2
   name: clusterpodconventions.conventions.carto.run
 spec:
   group: conventions.carto.run
diff --git a/config/crd/bases/conventions.carto.run_podintents.yaml b/config/crd/bases/conventions.carto.run_podintents.yaml
index 8feef7e6..908ad26b 100644
--- a/config/crd/bases/conventions.carto.run_podintents.yaml
+++ b/config/crd/bases/conventions.carto.run_podintents.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.16.2
   name: podintents.conventions.carto.run
 spec:
   group: conventions.carto.run
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 9e8b2b60..98d4b531 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -5,46 +5,47 @@ metadata:
   name: manager-role
 rules:
 - apiGroups:
-  - cert-manager.io
+  - ""
   resources:
-  - certificaterequests
+  - configmaps
+  - events
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
-  - conventions.carto.run
+  - ""
   resources:
-  - clusterpodconventions
+  - secrets
+  - serviceaccounts
   verbs:
   - get
   - list
   - watch
 - apiGroups:
-  - conventions.carto.run
+  - cert-manager.io
   resources:
-  - podintents
+  - certificaterequests
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - conventions.carto.run
   resources:
-  - podintents/status
+  - clusterpodconventions
   verbs:
   - get
-  - patch
-  - update
+  - list
+  - watch
 - apiGroups:
-  - ""
+  - conventions.carto.run
   resources:
-  - configmaps
-  - events
+  - podintents
   verbs:
   - create
   - delete
@@ -54,11 +55,10 @@ rules:
   - update
   - watch
 - apiGroups:
-  - ""
+  - conventions.carto.run
   resources:
-  - secrets
-  - serviceaccounts
+  - podintents/status
   verbs:
   - get
-  - list
-  - watch
+  - patch
+  - update
diff --git a/dist/cartographer-conventions.yaml b/dist/cartographer-conventions.yaml
index a79128e3..9dfd88b9 100644
--- a/dist/cartographer-conventions.yaml
+++ b/dist/cartographer-conventions.yaml
@@ -10,7 +10,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.16.2
   labels:
     app.kubernetes.io/component: conventions
   name: clusterpodconventions.conventions.carto.run
@@ -123,7 +123,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.16.2
   labels:
     app.kubernetes.io/component: conventions
     duck.knative.dev/podspecable: "true"
@@ -7518,46 +7518,47 @@ metadata:
   name: cartographer-conventions-manager-role
 rules:
 - apiGroups:
-  - cert-manager.io
+  - ""
   resources:
-  - certificaterequests
+  - configmaps
+  - events
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
-  - conventions.carto.run
+  - ""
   resources:
-  - clusterpodconventions
+  - secrets
+  - serviceaccounts
   verbs:
   - get
   - list
   - watch
 - apiGroups:
-  - conventions.carto.run
+  - cert-manager.io
   resources:
-  - podintents
+  - certificaterequests
   verbs:
-  - create
-  - delete
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - conventions.carto.run
   resources:
-  - podintents/status
+  - clusterpodconventions
   verbs:
   - get
-  - patch
-  - update
+  - list
+  - watch
 - apiGroups:
-  - ""
+  - conventions.carto.run
   resources:
-  - configmaps
-  - events
+  - podintents
   verbs:
   - create
   - delete
@@ -7567,14 +7568,13 @@ rules:
   - update
   - watch
 - apiGroups:
-  - ""
+  - conventions.carto.run
   resources:
-  - secrets
-  - serviceaccounts
+  - podintents/status
   verbs:
   - get
-  - list
-  - watch
+  - patch
+  - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
diff --git a/hack/go.mod b/hack/go.mod
index 05b1315b..0284da03 100644
--- a/hack/go.mod
+++ b/hack/go.mod
@@ -6,7 +6,7 @@ require (
 	carvel.dev/ytt v0.50.0
 	golang.org/x/tools v0.24.0
 	reconciler.io/dies/diegen v0.14.0
-	sigs.k8s.io/controller-tools v0.16.1
+	sigs.k8s.io/controller-tools v0.16.2
 	sigs.k8s.io/kustomize/kustomize/v5 v5.4.3
 )
 
diff --git a/hack/go.sum b/hack/go.sum
index ddc48f55..dd7edc8c 100644
--- a/hack/go.sum
+++ b/hack/go.sum
@@ -235,8 +235,8 @@ k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 reconciler.io/dies/diegen v0.14.0 h1:3EGR4c6Dh80SIMBZXA9fg5f52Wq/DZwlnCNuN1dhgJM=
 reconciler.io/dies/diegen v0.14.0/go.mod h1:HqlQEX5qI+xJZdY+JbsFTZd8Y+qOJAApeqCZ46z346E=
-sigs.k8s.io/controller-tools v0.16.1 h1:gvIsZm+2aimFDIBiDKumR7EBkc+oLxljoUVfRbDI6RI=
-sigs.k8s.io/controller-tools v0.16.1/go.mod h1:0I0xqjR65YTfoO12iR+mZR6s6UAVcUARgXRlsu0ljB0=
+sigs.k8s.io/controller-tools v0.16.2 h1:uUFF/AW3phBWPiERvkSNOVct//L427bPS7xGfKi6Tz4=
+sigs.k8s.io/controller-tools v0.16.2/go.mod h1:0I0xqjR65YTfoO12iR+mZR6s6UAVcUARgXRlsu0ljB0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kustomize/api v0.17.3 h1:6GCuHSsxq7fN5yhF2XrC+AAr8gxQwhexgHflOAD/JJU=
diff --git a/webhook/hack/go.mod b/webhook/hack/go.mod
index 05b1315b..0284da03 100644
--- a/webhook/hack/go.mod
+++ b/webhook/hack/go.mod
@@ -6,7 +6,7 @@ require (
 	carvel.dev/ytt v0.50.0
 	golang.org/x/tools v0.24.0
 	reconciler.io/dies/diegen v0.14.0
-	sigs.k8s.io/controller-tools v0.16.1
+	sigs.k8s.io/controller-tools v0.16.2
 	sigs.k8s.io/kustomize/kustomize/v5 v5.4.3
 )
 
diff --git a/webhook/hack/go.sum b/webhook/hack/go.sum
index ddc48f55..dd7edc8c 100644
--- a/webhook/hack/go.sum
+++ b/webhook/hack/go.sum
@@ -235,8 +235,8 @@ k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 reconciler.io/dies/diegen v0.14.0 h1:3EGR4c6Dh80SIMBZXA9fg5f52Wq/DZwlnCNuN1dhgJM=
 reconciler.io/dies/diegen v0.14.0/go.mod h1:HqlQEX5qI+xJZdY+JbsFTZd8Y+qOJAApeqCZ46z346E=
-sigs.k8s.io/controller-tools v0.16.1 h1:gvIsZm+2aimFDIBiDKumR7EBkc+oLxljoUVfRbDI6RI=
-sigs.k8s.io/controller-tools v0.16.1/go.mod h1:0I0xqjR65YTfoO12iR+mZR6s6UAVcUARgXRlsu0ljB0=
+sigs.k8s.io/controller-tools v0.16.2 h1:uUFF/AW3phBWPiERvkSNOVct//L427bPS7xGfKi6Tz4=
+sigs.k8s.io/controller-tools v0.16.2/go.mod h1:0I0xqjR65YTfoO12iR+mZR6s6UAVcUARgXRlsu0ljB0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kustomize/api v0.17.3 h1:6GCuHSsxq7fN5yhF2XrC+AAr8gxQwhexgHflOAD/JJU=