diff --git a/pkg/render/kubecontrollers/kube-controllers.go b/pkg/render/kubecontrollers/kube-controllers.go
index bb0fecd785..cafe5c5899 100644
--- a/pkg/render/kubecontrollers/kube-controllers.go
+++ b/pkg/render/kubecontrollers/kube-controllers.go
@@ -458,9 +458,10 @@ func kubeControllersRoleCommonRules(cfg *KubeControllersConfiguration) []rbacv1.
 		},
 		{
 			// IPAM resources are manipulated in response to node and block updates, as well as periodic triggers.
+			// The node controller watches IPReservations to report how much of each pool they cover.
 			APIGroups: []string{"projectcalico.org", "crd.projectcalico.org"},
 			Resources: []string{"ipreservations"},
-			Verbs:     []string{"list"},
+			Verbs:     []string{"list", "watch"},
 		},
 		{
 			APIGroups: []string{"projectcalico.org", "crd.projectcalico.org"},