diff --git a/charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml b/charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml
index 75313f8063..01e24b585a 100644
--- a/charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml
+++ b/charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml
@@ -8,4 +8,4 @@ aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
         rbac.manila.csi.openstack.org/aggregate-to-controller-{{ include "openstack-manila-csi.name" . }}: "true"
-rules: []
+{{- /* do not set rules: clusterrole-aggregation-controller owns that field; Helm SSA applying rules: [] conflicts on upgrade */}}
diff --git a/charts/manila-csi-plugin/templates/nodeplugin-clusterrole.yaml b/charts/manila-csi-plugin/templates/nodeplugin-clusterrole.yaml
index f8261b83a6..6028121fa6 100644
--- a/charts/manila-csi-plugin/templates/nodeplugin-clusterrole.yaml
+++ b/charts/manila-csi-plugin/templates/nodeplugin-clusterrole.yaml
@@ -8,4 +8,4 @@ aggregationRule:
   clusterRoleSelectors:
     - matchLabels:
         rbac.manila.csi.openstack.org/aggregate-to-nodeplugin-{{ include "openstack-manila-csi.name" . }}: "true"
-rules: []
+{{- /* do not set rules: clusterrole-aggregation-controller owns that field; Helm SSA applying rules: [] conflicts on upgrade */}}