diff --git a/config/rbac/controller/role.yaml b/config/rbac/controller/role.yaml
index 6e0b9485..2e56895f 100644
--- a/config/rbac/controller/role.yaml
+++ b/config/rbac/controller/role.yaml
@@ -86,7 +86,17 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
+- apiGroups:
+  - billing.appuio.io
+  resources:
+  - billingentities/status
+  verbs:
+  - get
+  - patch
+  - update
 - apiGroups:
   - organization.appuio.io
   resources:
@@ -114,6 +124,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - rbac.appuio.io
@@ -197,21 +209,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - user.appuio.io
-  resources:
-  - billingentities
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - user.appuio.io
-  resources:
-  - billingentities/status
-  verbs:
-  - get
-  - patch
-  - update
 - apiGroups:
   - user.appuio.io
   resources:
diff --git a/controllers/billingentity_email_cronjob.go b/controllers/billingentity_email_cronjob.go
index fc2334b5..c41605ab 100644
--- a/controllers/billingentity_email_cronjob.go
+++ b/controllers/billingentity_email_cronjob.go
@@ -52,10 +52,10 @@ func (r *BillingEntityEmailCronJob) GetMetrics() prometheus.Collector {
 	return reg
 }
 
-//+kubebuilder:rbac:groups="rbac.appuio.io",resources=billingentities,verbs=get;list
-//+kubebuilder:rbac:groups="user.appuio.io",resources=billingentities,verbs=get;list
+//+kubebuilder:rbac:groups="rbac.appuio.io",resources=billingentities,verbs=get;list;update;patch
+//+kubebuilder:rbac:groups="billing.appuio.io",resources=billingentities,verbs=get;list;update;patch
 //+kubebuilder:rbac:groups="rbac.appuio.io",resources=billingentities/status,verbs=get;update;patch
-//+kubebuilder:rbac:groups="user.appuio.io",resources=billingentities/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups="billing.appuio.io",resources=billingentities/status,verbs=get;update;patch
 
 // Run lists all BillingEntity resources and sends notification emails if needed.
 func (r *BillingEntityEmailCronJob) Run(ctx context.Context) error {