diff --git a/extra-manifests/toolshed-deployer-rbac.yaml b/extra-manifests/toolshed-deployer-rbac.yaml
index d24a966..644934e 100644
--- a/extra-manifests/toolshed-deployer-rbac.yaml
+++ b/extra-manifests/toolshed-deployer-rbac.yaml
@@ -57,6 +57,19 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # An app with persistent storage is a StatefulSet instead of a Deployment
+  # (internal/deploy.Client.ensureStatefulSet). Delete is needed on both:
+  # switching an app between stateless and stateful must remove whichever
+  # controller it no longer is, or the two fight over the same pods.
+  - apiGroups: ["apps"]
+    resources: ["statefulsets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Read-only. The claims themselves are created by the StatefulSet's own
+  # volumeClaimTemplates, never directly here — this is only to observe
+  # them, and deleting one would destroy an app's data.
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch"]
   # The policy that stops one app reaching another.
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]