diff --git a/apps/backstage/deployment.yaml b/apps/backstage/deployment.yaml
index f709622..d1d616c 100644
--- a/apps/backstage/deployment.yaml
+++ b/apps/backstage/deployment.yaml
@@ -5,6 +5,7 @@ metadata:
   namespace: backstage
   labels:
     app.kubernetes.io/name: backstage
+    backstage.io/kubernetes-id: homelab-backstage
 spec:
   replicas: 1
   strategy:
@@ -16,6 +17,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: backstage
+        backstage.io/kubernetes-id: homelab-backstage
     spec:
       serviceAccountName: backstage
       securityContext:
@@ -25,7 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: backstage
-          image: zot.ad.ddupan.top/panxiao81/backstage@sha256:493aed471c58b21db7a108a333417498fc03682d119282b89cd0318563d6cae6
+          image: zot.ad.ddupan.top/panxiao81/backstage@sha256:e5a12550726f19a680bc7c40e2cc07cc624318f9279ee121814d293a006ef210
           imagePullPolicy: IfNotPresent
           env:
             - name: BACKSTAGE_BASE_URL
diff --git a/apps/backstage/kustomization.yaml b/apps/backstage/kustomization.yaml
index 6141cf0..b8b39b6 100644
--- a/apps/backstage/kustomization.yaml
+++ b/apps/backstage/kustomization.yaml
@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - serviceaccount.yaml
+  - rbac.yaml
   - external-secret.yaml
   - deployment.yaml
   - service.yaml
diff --git a/apps/backstage/rbac.yaml b/apps/backstage/rbac.yaml
new file mode 100644
index 0000000..9ee9b92
--- /dev/null
+++ b/apps/backstage/rbac.yaml
@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: backstage-read-only
+rules:
+  - apiGroups: [""]
+    resources:
+      - configmaps
+      - limitranges
+      - pods
+      - pods/log
+      - resourcequotas
+      - services
+    verbs: [get, list, watch]
+  - apiGroups: [apps]
+    resources:
+      - daemonsets
+      - deployments
+      - replicasets
+      - statefulsets
+    verbs: [get, list, watch]
+  - apiGroups: [autoscaling]
+    resources:
+      - horizontalpodautoscalers
+    verbs: [get, list, watch]
+  - apiGroups: [batch]
+    resources:
+      - cronjobs
+      - jobs
+    verbs: [get, list, watch]
+  - apiGroups: [networking.k8s.io]
+    resources:
+      - ingresses
+    verbs: [get, list, watch]
+  - apiGroups: [metrics.k8s.io]
+    resources:
+      - pods
+    verbs: [get, list]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backstage-read-only
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: backstage-read-only
+subjects:
+  - kind: ServiceAccount
+    name: backstage
+    namespace: backstage
diff --git a/apps/backstage/service.yaml b/apps/backstage/service.yaml
index 21ba1a1..bc05747 100644
--- a/apps/backstage/service.yaml
+++ b/apps/backstage/service.yaml
@@ -3,6 +3,8 @@ kind: Service
 metadata:
   name: backstage
   namespace: backstage
+  labels:
+    backstage.io/kubernetes-id: homelab-backstage
 spec:
   selector:
     app.kubernetes.io/name: backstage
diff --git a/apps/backstage/serviceaccount.yaml b/apps/backstage/serviceaccount.yaml
index b427db8..b1d2a18 100644
--- a/apps/backstage/serviceaccount.yaml
+++ b/apps/backstage/serviceaccount.yaml
@@ -3,4 +3,4 @@ kind: ServiceAccount
 metadata:
   name: backstage
   namespace: backstage
-automountServiceAccountToken: false
+automountServiceAccountToken: true