diff --git a/management-platform-sites-rbac.yaml b/management-platform-sites-rbac.yaml
new file mode 100644
index 0000000..c2f48b6
--- /dev/null
+++ b/management-platform-sites-rbac.yaml
@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: management-platform-ingress-reader-role
+  labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
+rules:
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+---
+# Odoo's and Nextcloud's Ingress objects live in the `default` namespace
+# (historical — created there during the original Docker->k8s migration,
+# unlike n8n/mautic/erpnext whose Ingress lives in their own app namespace).
+# management-platform-sa has no binding at all in `default` otherwise, and
+# `default` also hosts unrelated live services (cloudops-ingress, jenkins-
+# ingress, stage-navitrends-ingress, etc.) — so this grants ONLY ingress
+# read there, not the full backup ClusterRole, to keep blast radius to
+# exactly what the Application Sites page needs (real domain/TLS lookup).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: management-platform-ingress-reader-binding
+  namespace: default
+  labels: {owner: ameni-boukattaya, app.kubernetes.io/managed-by: navitrends-pfe-migration}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: management-platform-ingress-reader-role
+subjects:
+  - kind: ServiceAccount
+    name: management-platform-sa
+    namespace: management-platform