diff --git a/extra-manifests/toolshed-deployer-rbac.yaml b/extra-manifests/toolshed-deployer-rbac.yaml
index 7137f70..b240275 100644
--- a/extra-manifests/toolshed-deployer-rbac.yaml
+++ b/extra-manifests/toolshed-deployer-rbac.yaml
@@ -48,9 +48,11 @@ rules:
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get", "create", "update", "patch", "delete"]
-  # Read-only. Pods are listed to report why a rollout failed, never changed.
+  # Read-only. Pods are listed to report why a rollout failed, never changed,
+  # and their output is read so an app's own logs can be shown in the
+  # dashboard without anyone reaching for kubectl.
   - apiGroups: [""]
-    resources: ["pods"]
+    resources: ["pods", "pods/log"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["apps"]
     resources: ["deployments"]