diff --git a/cloud/k3s/docopts.md b/cloud/k3s/docopts.md
index 49a4bd1..6877b4c 100644
--- a/cloud/k3s/docopts.md
+++ b/cloud/k3s/docopts.md
@@ -28,6 +28,7 @@ Usage:
   k3s delete <server> [<user>]
   k3s info
   k3s kubeconfig <server> [<user>]
+  k3s rbac
   k3s status
 ```
 
@@ -38,5 +39,17 @@ Usage:
   delete     uninstall k3s with ssh in <server> using <username> with sudo
   info       info on the server
   kubeconfig recover the kubeconfig from a k3s server <server> with user <username>
+  rbac       install Admin API user provisioning permissions
   status     status of the server
-```
\ No newline at end of file
+```
+
+`create` also installs the user provisioning RBAC. To apply it to an existing
+cluster, run `ops cloud k3s rbac` with that cluster's kubeconfig selected.
+The task creates the `openserverless` namespace if absent, then applies the
+bundled Role and RoleBinding for the Admin API service account
+`openserverless-wsku`. The service account is created by the OpenServerless
+installation; the binding may be installed before it exists.
+
+This grants permissions for the provisioning feature. The provisioning token
+Secret must still be supplied separately; the task does not generate or
+overwrite it. Existing broader roles are unchanged.
diff --git a/cloud/k3s/opsfile.yml b/cloud/k3s/opsfile.yml
index 1c91124..d289463 100644
--- a/cloud/k3s/opsfile.yml
+++ b/cloud/k3s/opsfile.yml
@@ -73,8 +73,18 @@ tasks:
         do echo waiting default storage class ; sleep 1
         done
       - ops util cert-manager
+      - ops cloud k3s rbac
       - cp "$OPS_TMP/kubeconfig" "$OPS_TMP/k3s-{{._server_}}.kubeconfig"
 
+  rbac:
+    desc: install Admin API user provisioning permissions
+    silent: true
+    cmds:
+      - >
+        kubectl get namespace openserverless >/dev/null 2>&1 ||
+        kubectl create namespace openserverless
+      - kubectl apply -f "$OPS_ROOT/cloud/k3s/user-provisioning-rbac.yaml"
+
   delete:
     vars:
       INSTALL_USER: '{{._user_ | default "root"}}'
diff --git a/cloud/k3s/user-provisioning-rbac.yaml b/cloud/k3s/user-provisioning-rbac.yaml
new file mode 100644
index 0000000..51704b8
--- /dev/null
+++ b/cloud/k3s/user-provisioning-rbac.yaml
@@ -0,0 +1,65 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Optional feature permissions. Apply only when enabling user provisioning.
+# Change the binding subject if Admin API uses a different service account.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: openserverless-user-provisioning
+  namespace: openserverless
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    resourceNames: [openserverless-user-provisioning-token]
+    verbs: [get]
+  - apiGroups: [openserverless.org]
+    resources: [whisks]
+    resourceNames: [controller]
+    verbs: [get]
+  - apiGroups: [openserverless.org]
+    resources: [whisksusers]
+    verbs: [get, create]
+  - apiGroups: [networking.k8s.io]
+    resources: [ingresses]
+    resourceNames: [apihost]
+    verbs: [get]
+  - apiGroups: [networking.k8s.io]
+    resources: [ingresses]
+    verbs: [create]
+  - apiGroups: [traefik.io]
+    resources: [middlewares]
+    verbs: [create]
+  - apiGroups: [""]
+    resources: [services]
+    resourceNames: [openserverless-streamer-api]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: openserverless-user-provisioning
+  namespace: openserverless
+subjects:
+  - kind: ServiceAccount
+    name: openserverless-wsku
+    namespace: openserverless
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: openserverless-user-provisioning