diff --git a/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml b/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml
index b4d5bb2790..e356ca79d7 100644
--- a/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml
+++ b/kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/rbac.yaml
@@ -9,5 +9,5 @@ kind: ServiceAccount
 metadata:
   name: cluster-runner
 spec:
-  # Only use is 'talosctl image pull' in image-pull.yaml.
-  roles: ["os:reader"]
+  # Only use is 'talosctl image pull' in image-pull.yaml; ImagePull needs os:operator (not os:reader).
+  roles: ["os:operator"]