diff --git a/controller/config/default/manager_auth_proxy_patch.yaml b/controller/config/default/manager_auth_proxy_patch.yaml
index a6d369b35c..cfdbd98dcf 100644
--- a/controller/config/default/manager_auth_proxy_patch.yaml
+++ b/controller/config/default/manager_auth_proxy_patch.yaml
@@ -36,5 +36,5 @@ spec:
         - "--health-probe-bind-address=:8081"
         - "--metrics-bind-address=127.0.0.1:8080"
         - "--leader-elect"
-        - --console-url=$CONSOLE_URL
-        - --console-token=$CONSOLE_TOKEN
+        - --console-url=$(CONSOLE_URL)
+        - --console-token=$(CONSOLE_TOKEN)
diff --git a/controller/config/manager/manager.yaml b/controller/config/manager/manager.yaml
index f00ce25f2a..fd7421548a 100644
--- a/controller/config/manager/manager.yaml
+++ b/controller/config/manager/manager.yaml
@@ -32,8 +32,8 @@ spec:
             - /manager
           args:
             - --leader-elect
-            - --console-url="$(CONSOLE_URL)"
-            - --console-token=$CONSOLE_TOKEN
+            - --console-url=$(CONSOLE_URL)
+            - --console-token=$(CONSOLE_TOKEN)
           image: deployment-controller:latest
           imagePullPolicy: Never
           name: manager
diff --git a/controller/config/manager/secret.yaml b/controller/config/manager/secret.yaml
index cf70fcb418..deac172c2b 100644
--- a/controller/config/manager/secret.yaml
+++ b/controller/config/manager/secret.yaml
@@ -3,5 +3,5 @@ kind: Secret
 metadata:
   name: secrets
 stringData:
-  consoleUrl: "$PLURAL_CONSOLE_URL" # replaced with envsubst
-  consoleToken: "$PLURAL_CONSOLE_TOKEN" # replaced with envsubst
+  consoleUrl: $PLURAL_CONSOLE_URL/gql # replaced with envsubst
+  consoleToken: $PLURAL_CONSOLE_TOKEN # replaced with envsubst
diff --git a/controller/config/rbac/role.yaml b/controller/config/rbac/role.yaml
index af402d1dc4..0a521606c6 100644
--- a/controller/config/rbac/role.yaml
+++ b/controller/config/rbac/role.yaml
@@ -11,6 +11,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -18,6 +19,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - deployments.plural.sh
   resources:
diff --git a/controller/internal/controller/gitrepository_controller.go b/controller/internal/controller/gitrepository_controller.go
index e49c9a2704..e2e1da8477 100644
--- a/controller/internal/controller/gitrepository_controller.go
+++ b/controller/internal/controller/gitrepository_controller.go
@@ -47,7 +47,7 @@ type GitRepositoryReconciler struct {
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=gitrepositories,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=gitrepositories/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=gitrepositories/finalizers,verbs=update
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
 
 func (r *GitRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Result, reterr error) {
 	logger := log.FromContext(ctx)
diff --git a/controller/internal/controller/provider_controller.go b/controller/internal/controller/provider_controller.go
index 7116781c1d..795b575383 100644
--- a/controller/internal/controller/provider_controller.go
+++ b/controller/internal/controller/provider_controller.go
@@ -38,7 +38,7 @@ const (
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=providers,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=providers/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=providers/finalizers,verbs=update
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the v1alpha1.Provider closer to the desired state
diff --git a/controller/internal/controller/servicedeployment_controller.go b/controller/internal/controller/servicedeployment_controller.go
index e478cd718e..ee23c77e4b 100644
--- a/controller/internal/controller/servicedeployment_controller.go
+++ b/controller/internal/controller/servicedeployment_controller.go
@@ -36,8 +36,8 @@ type ServiceReconciler struct {
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=servicedeployments,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=servicedeployments/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=deployments.plural.sh,resources=servicedeployments/finalizers,verbs=update
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list
-// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
+// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch
 
 func (r *ServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Result, reterr error) {
 	logger := log.FromContext(ctx)