diff --git a/lib/resourcemerge/rbac.go b/lib/resourcemerge/rbac.go
index e39e843add..0d872038c0 100644
--- a/lib/resourcemerge/rbac.go
+++ b/lib/resourcemerge/rbac.go
@@ -27,6 +27,10 @@ func EnsureClusterRole(modified *bool, existing *rbacv1.ClusterRole, required rb
 		*modified = true
 		existing.Rules = required.Rules
 	}
+	if !equality.Semantic.DeepEqual(existing.AggregationRule, required.AggregationRule) {
+		*modified = true
+		existing.AggregationRule = required.AggregationRule
+	}
 }
 
 // EnsureRoleBinding ensures that the existing matches the required.
diff --git a/lib/resourcemerge/rbacv1beta1.go b/lib/resourcemerge/rbacv1beta1.go
index d9e84d5954..fa3cf17c11 100644
--- a/lib/resourcemerge/rbacv1beta1.go
+++ b/lib/resourcemerge/rbacv1beta1.go
@@ -27,6 +27,10 @@ func EnsureClusterRolev1beta1(modified *bool, existing *rbacv1beta1.ClusterRole,
 		*modified = true
 		existing.Rules = required.Rules
 	}
+	if !equality.Semantic.DeepEqual(existing.AggregationRule, required.AggregationRule) {
+		*modified = true
+		existing.AggregationRule = required.AggregationRule
+	}
 }
 
 // EnsureRoleBindingv1beta1 ensures that the existing matches the required.