diff --git a/apps/api/infra/base/deployment.yaml b/apps/api/infra/base/deployment.yaml
index 50aab31..7a62385 100644
--- a/apps/api/infra/base/deployment.yaml
+++ b/apps/api/infra/base/deployment.yaml
@@ -14,6 +14,8 @@ spec:
     metadata:
       labels:
         app: hightower-api
+      annotations:
+        kubectl.kubernetes.io/restartedAt: "2026-04-21T12:45:00Z"
     spec:
       serviceAccountName: hightower-api
       containers:
diff --git a/apps/api/infra/base/rbac.yaml b/apps/api/infra/base/rbac.yaml
index c44857f..6da2114 100644
--- a/apps/api/infra/base/rbac.yaml
+++ b/apps/api/infra/base/rbac.yaml
@@ -27,3 +27,27 @@ roleRef:
   kind: Role
   name: hightower-api
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: hightower-deploy-manager
+  namespace: hightower
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: farh-net-deploy-manager
+  namespace: hightower
+subjects:
+  - kind: ServiceAccount
+    name: farh-net-paperclip
+    namespace: farh-net
+roleRef:
+  kind: Role
+  name: hightower-deploy-manager
+  apiGroup: rbac.authorization.k8s.io