diff --git a/extra-manifests/toolshed-deployer-rbac.yaml b/extra-manifests/toolshed-deployer-rbac.yaml
index b240275..8ee8ea2 100644
--- a/extra-manifests/toolshed-deployer-rbac.yaml
+++ b/extra-manifests/toolshed-deployer-rbac.yaml
@@ -61,6 +61,15 @@ rules:
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  # Created only for an app with autoscaling enabled (max replicas set
+  # above min); removed again if it's turned back off. See toolshed's own
+  # internal/deploy.Client.ensureAutoscaler. Added alongside that feature —
+  # keep this file and toolshed's deploy/helm/toolshed/templates/rbac.yaml
+  # in sync, per internal/deploy/kubernetes.go's own package doc warning
+  # that the two are unsynchronized copies in two repositories.
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding