diff --git a/component/loki.libsonnet b/component/loki.libsonnet
index bb5aa66..09e406f 100644
--- a/component/loki.libsonnet
+++ b/component/loki.libsonnet
@@ -126,6 +126,7 @@ if loki.enabled then
     '50_loki_rbac': [ aggregate_loki_log_access ],
     '50_loki_operator_metrics_token': workaround.missing_metrics_token,
     '50_loki_ingester_fix': workaround.ingester_stuck,
+    '50_loki_logreader_fix': workaround.app_logs_reader,
   }
 else
   std.trace(
diff --git a/component/loki_workaround.libsonnet b/component/loki_workaround.libsonnet
index 063a329..2f2e0f0 100644
--- a/component/loki_workaround.libsonnet
+++ b/component/loki_workaround.libsonnet
@@ -1,7 +1,6 @@
 local com = import 'lib/commodore.libjsonnet';
 local kap = import 'lib/kapitan.libjsonnet';
 local kube = import 'lib/kube.libjsonnet';
-local po = import 'lib/patch-operator.libsonnet';
 
 // The hiera parameters for the component
 local inv = kap.inventory();
@@ -30,6 +29,22 @@ local missing_metrics_token =
     type: 'kubernetes.io/service-account-token',
   };
 
+// ClusterRole to aggregate to `admin`.
+local app_logs_reader =
+  kube.ClusterRole('logging-application-logs-reader-aggregate') {
+    metadata+: {
+      labels+: {
+        'rbac.authorization.k8s.io/aggregate-to-admin': 'true',
+      },
+    },
+    rules: [ {
+      apiGroups: [ 'loki.grafana.com' ],
+      resourceNames: [ 'logs' ],
+      resources: [ 'application' ],
+      verbs: [ 'get' ],
+    } ],
+  };
+
 
 // Workaround for stuck loki-ingester.
 // To be removed, once upstream is fixed.
@@ -134,4 +149,5 @@ local ingester_stuck = [
 {
   missing_metrics_token: [ missing_metrics_token ],
   ingester_stuck: ingester_stuck,
+  app_logs_reader: app_logs_reader,
 }
diff --git a/tests/golden/defaults/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml b/tests/golden/defaults/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
new file mode 100644
index 0000000..5e7989d
--- /dev/null
+++ b/tests/golden/defaults/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: logging-application-logs-reader-aggregate
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+  name: logging-application-logs-reader-aggregate
+rules:
+  - apiGroups:
+      - loki.grafana.com
+    resourceNames:
+      - logs
+    resources:
+      - application
+    verbs:
+      - get
diff --git a/tests/golden/legacy/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml b/tests/golden/legacy/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
new file mode 100644
index 0000000..5e7989d
--- /dev/null
+++ b/tests/golden/legacy/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: logging-application-logs-reader-aggregate
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+  name: logging-application-logs-reader-aggregate
+rules:
+  - apiGroups:
+      - loki.grafana.com
+    resourceNames:
+      - logs
+    resources:
+      - application
+    verbs:
+      - get
diff --git a/tests/golden/master/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml b/tests/golden/master/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
new file mode 100644
index 0000000..5e7989d
--- /dev/null
+++ b/tests/golden/master/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: logging-application-logs-reader-aggregate
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+  name: logging-application-logs-reader-aggregate
+rules:
+  - apiGroups:
+      - loki.grafana.com
+    resourceNames:
+      - logs
+    resources:
+      - application
+    verbs:
+      - get
diff --git a/tests/golden/multilineerr/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml b/tests/golden/multilineerr/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
new file mode 100644
index 0000000..5e7989d
--- /dev/null
+++ b/tests/golden/multilineerr/openshift4-logging/openshift4-logging/50_loki_logreader_fix.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations: {}
+  labels:
+    name: logging-application-logs-reader-aggregate
+    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
+  name: logging-application-logs-reader-aggregate
+rules:
+  - apiGroups:
+      - loki.grafana.com
+    resourceNames:
+      - logs
+    resources:
+      - application
+    verbs:
+      - get