diff --git a/cmd/webhook/main.go b/cmd/webhook/main.go
index 7c007c16..c362c120 100644
--- a/cmd/webhook/main.go
+++ b/cmd/webhook/main.go
@@ -22,9 +22,9 @@ import (
 	"github.com/tektoncd/pruner/pkg/webhook"
 	"k8s.io/client-go/tools/cache"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
-	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
+	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
 	"knative.dev/pkg/injection/sharedmain"
 	"knative.dev/pkg/logging"
 	"knative.dev/pkg/signals"
diff --git a/config/200-clusterrole.yaml b/config/200-clusterrole.yaml
index 1e4a7cb8..2f4557c9 100644
--- a/config/200-clusterrole.yaml
+++ b/config/200-clusterrole.yaml
@@ -46,22 +46,18 @@ rules:
       - "patch"
       - "watch"
 
-  # used in webhook
+  # used in webhook — scoped to the single ValidatingWebhookConfiguration
   - apiGroups:
       - admissionregistration.k8s.io
     resources:
-      - mutatingwebhookconfigurations
       - validatingwebhookconfigurations
+    resourceNames:
+      - validation.webhook.pruner.tekton.dev
     verbs:
       - get
-      - list
-      - create
       - update
-      - delete
-      - patch
-      - watch
 
-  # used in webhook
+  # namespace informer (read-only)
   - apiGroups:
       - ""
     resources:
@@ -69,19 +65,8 @@ rules:
     verbs:
       - get
       - list
-      - create
-      - update
-      - delete
-      - patch
       - watch
 
-  - apiGroups:
-      - ""
-    resources:
-      - namespaces/finalizers
-    verbs:
-      - update
-
   - apiGroups:
       - ""
     resources:
@@ -99,13 +84,3 @@ rules:
       - tekton-pruner-namespace-spec
     verbs:
       - get
-
-  # used in webhook for certificate management
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch