diff --git a/dev/backstage/service-account.yaml b/dev/backstage/service-account.yaml
index ccff891..2ca15f6 100644
--- a/dev/backstage/service-account.yaml
+++ b/dev/backstage/service-account.yaml
@@ -19,35 +19,60 @@ rules:
       - resourcequotas
       - limitranges
       - namespaces
-    verbs: ["get", "list", "watch"]
+    verbs:
+      - get
+      - list
+      - watch
 
-  # Apps
+  # Apps API group
   - apiGroups: ["apps"]
     resources:
       - deployments
       - statefulsets
       - daemonsets
       - replicasets
-    verbs: ["get", "list", "watch"]
+    verbs:
+      - get
+      - list
+      - watch
 
-  # Batch
+  # Batch API group
   - apiGroups: ["batch"]
     resources:
       - jobs
       - cronjobs
-    verbs: ["get", "list", "watch"]
+    verbs:
+      - get
+      - list
+      - watch
 
-  # Autoscaling
+  # Autoscaling API group
   - apiGroups: ["autoscaling"]
     resources:
       - horizontalpodautoscalers
-    verbs: ["get", "list", "watch"]
+    verbs:
+      - get
+      - list
+      - watch
 
-  # Networking
+  # Networking API group
   - apiGroups: ["networking.k8s.io"]
     resources:
       - ingresses
-    verbs: ["get", "list", "watch"]
+    verbs:
+      - get
+      - list
+      - watch
+
+  # Metrics API group (fix for your last 403)
+  - apiGroups: ["metrics.k8s.io"]
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding