diff --git a/k8s/bases/apps/github-config/rbac.yaml b/k8s/bases/apps/github-config/rbac.yaml
index 25a4e194d..678d133e9 100644
--- a/k8s/bases/apps/github-config/rbac.yaml
+++ b/k8s/bases/apps/github-config/rbac.yaml
@@ -26,6 +26,7 @@ metadata:
 rules:
   - apiGroups:
       - repo.github.m.upbound.io
+      - team.github.m.upbound.io
       - actions.github.m.upbound.io
       - enterprise.github.m.upbound.io
       - github.m.upbound.io
diff --git a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml
index 9cab20670..9700f4eb1 100644
--- a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml
+++ b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml
@@ -25,3 +25,9 @@ spec:
     # adopted Observe-first in devantler-tech/.github deploy/. The tenant Role
     # already covers the enterprise.github.m.upbound.io group.
     - organizationrulesets.enterprise.github.m.upbound.io
+    # Team management — the maintainers team + its membership and team->repo
+    # access (declared in devantler-tech/.github deploy/teams/). Lets a team be
+    # the canonical CODEOWNERS owner across the suite.
+    - teams.team.github.m.upbound.io
+    - teammemberships.team.github.m.upbound.io
+    - teamrepositories.team.github.m.upbound.io