diff --git a/pkg/rbac/restore_job.go b/pkg/rbac/restore_job.go
index 9729240fc..0f1b6bc8b 100644
--- a/pkg/rbac/restore_job.go
+++ b/pkg/rbac/restore_job.go
@@ -12,6 +12,7 @@ import (
 	rbac_util "kmodules.xyz/client-go/rbac/v1"
 	api_v1alpha1 "stash.appscode.dev/stash/apis/stash/v1alpha1"
 	api_v1beta1 "stash.appscode.dev/stash/apis/stash/v1beta1"
+	appCatalog "kmodules.xyz/custom-resources/apis/appcatalog/v1alpha1"
 )
 
 const (
@@ -55,6 +56,16 @@ func ensureRestoreJobClusterRole(kubeClient kubernetes.Interface, psps []string,
 				Resources: []string{api_v1alpha1.ResourcePluralRepository},
 				Verbs:     []string{"*"},
 			},
+			{
+				APIGroups: []string{appCatalog.SchemeGroupVersion.Group},
+				Resources: []string{appCatalog.ResourceApps},
+				Verbs:     []string{"get"},
+			},
+			{
+				APIGroups: []string{core.SchemeGroupVersion.Group},
+				Resources: []string{"secrets"},
+				Verbs:     []string{"get"},
+			},
 			{
 				APIGroups: []string{core.GroupName},
 				Resources: []string{"events"},