diff --git a/Makefile b/Makefile
index b2a4570c..da284c32 100644
--- a/Makefile
+++ b/Makefile
@@ -114,7 +114,7 @@ check: FORCE static-check build/cover.html build-all
 
 generate: install-controller-gen
 	@printf "\e[1;36m>> controller-gen\e[0m\n"
-	@controller-gen crd:allowDangerousTypes=true rbac:roleName=hypervisor-operator-manager-role webhook paths="./..." output:crd:artifacts:config=charts/openstack-hypervisor-operator/crds output:rbac:artifacts:config=charts/openstack-hypervisor-operator/templates
+	@controller-gen crd:allowDangerousTypes=true rbac:roleName='"{{ include \"openstack-hypervisor-operator.fullname\" . }}-manager-role"' webhook paths="./..." output:crd:artifacts:config=charts/openstack-hypervisor-operator/crds output:rbac:artifacts:config=charts/openstack-hypervisor-operator/templates
 	@controller-gen object:headerFile="hack/boilerplate.go.txt",year=$(YEAR) paths="./..."
 	@controller-gen applyconfiguration paths="./..."
 
diff --git a/Makefile.maker.yaml b/Makefile.maker.yaml
index 13b73c28..8f19fbe7 100644
--- a/Makefile.maker.yaml
+++ b/Makefile.maker.yaml
@@ -9,7 +9,9 @@ controllerGen:
   enabled: true
   crdOutputPath: charts/openstack-hypervisor-operator/crds
   objectHeaderFile: hack/boilerplate.go.txt
-  rbacRoleName: hypervisor-operator-manager-role
+  # Release-scoped ClusterRole name (Helm template): multiple instances of
+  # this operator must not share RBAC objects in the same cluster.
+  rbacRoleName: '{{ include "openstack-hypervisor-operator.fullname" . }}-manager-role'
   rbacOutputPath: charts/openstack-hypervisor-operator/templates
   allowDangerousTypes: true
 
diff --git a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml
index 582c7628..38b4b72f 100644
--- a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml
+++ b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: evictions.kvm.cloud.sap
 spec:
   group: kvm.cloud.sap
diff --git a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml
index 8f418e33..1e10c618 100644
--- a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml
+++ b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: hypervisors.kvm.cloud.sap
 spec:
   group: kvm.cloud.sap
diff --git a/charts/openstack-hypervisor-operator/templates/deployment.yaml b/charts/openstack-hypervisor-operator/templates/deployment.yaml
index 0452645e..a75ad937 100644
--- a/charts/openstack-hypervisor-operator/templates/deployment.yaml
+++ b/charts/openstack-hypervisor-operator/templates/deployment.yaml
@@ -58,7 +58,7 @@ spec:
             resourceFieldRef:
               resource: limits.memory
               divisor: "1"
-        image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Chart.AppVersion }}
+        image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag | default .Chart.AppVersion }}
         livenessProbe:
           httpGet:
             path: /healthz
diff --git a/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml b/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml
index 34537573..ac49e371 100644
--- a/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml
+++ b/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml
@@ -7,7 +7,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: hypervisor-operator-manager-role
+  name: {{ include "openstack-hypervisor-operator.fullname" . }}-manager-role
 subjects:
 - kind: ServiceAccount
   name: '{{ include "openstack-hypervisor-operator.serviceAccountName" . }}'
diff --git a/charts/openstack-hypervisor-operator/templates/role.yaml b/charts/openstack-hypervisor-operator/templates/role.yaml
index 3b1ecda8..d420447d 100644
--- a/charts/openstack-hypervisor-operator/templates/role.yaml
+++ b/charts/openstack-hypervisor-operator/templates/role.yaml
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: hypervisor-operator-manager-role
+  name: '{{ include "openstack-hypervisor-operator.fullname" . }}-manager-role'
 rules:
 - apiGroups:
   - ""
diff --git a/charts/openstack-hypervisor-operator/values.yaml b/charts/openstack-hypervisor-operator/values.yaml
index 22f61295..57cdb7df 100644
--- a/charts/openstack-hypervisor-operator/values.yaml
+++ b/charts/openstack-hypervisor-operator/values.yaml
@@ -34,6 +34,8 @@ controllerManager:
       osUsername: ""
     image:
       repository: ghcr.io/cobaltcore-dev/openstack-hypervisor-operator
+      # Defaults to Chart.AppVersion.
+      tag: null
     resources:
       limits:
         cpu: 500m