diff --git a/backend/controller/scaling/k8sscaling/deployment_provisioner.go b/backend/controller/scaling/k8sscaling/deployment_provisioner.go
index ab8175cc1e..23c25f3346 100644
--- a/backend/controller/scaling/k8sscaling/deployment_provisioner.go
+++ b/backend/controller/scaling/k8sscaling/deployment_provisioner.go
@@ -145,12 +145,6 @@ func (r *DeploymentProvisioner) handleSchemaChange(ctx context.Context, msg *ftl
 				// Nasty hack, we want all the controllers to have updated their route tables before we kill the runner
 				// so we add a slight delay here
 				time.Sleep(time.Second * 10)
-				logger.Debugf("Deleting deployment %s", msg.ModuleName)
-				err := deploymentClient.Delete(ctx, msg.DeploymentKey, v1.DeleteOptions{})
-				if err != nil {
-					logger.Errorf(err, "Failed to delete deployment %s", msg.ModuleName)
-				}
-				// TODO: we only need to delete the services once this new ownership structure has been deployed to production
 				// Existing deployments don't have this though
 				logger.Debugf("Deleting service %s", msg.ModuleName)
 				err = r.Client.CoreV1().Secrets(r.Namespace).Delete(ctx, msg.DeploymentKey, v1.DeleteOptions{})
diff --git a/deployment/base/ftl-controller/role.yaml b/deployment/base/ftl-controller/role.yaml
index 6978d1c5dc..ba88704d19 100644
--- a/deployment/base/ftl-controller/role.yaml
+++ b/deployment/base/ftl-controller/role.yaml
@@ -8,10 +8,13 @@ metadata:
 rules:
   - apiGroups: [ "apps" ]
     resources: [ "deployments" ]
-    verbs: [ "get", "list", "watch", "delete", "create", "update", "patch" ]
+    verbs: [ "get", "list", "watch", "create", "update", "patch" ]
   - apiGroups: [ "" ]
-    resources: [ "services" , "serviceaccounts"]
+    resources: [ "services" ]
     verbs: [ "get", "list", "watch", "delete", "create", "update", "patch" ]
+  - apiGroups: [ "" ]
+    resources: [ "serviceaccounts"]
+    verbs: [ "get", "list", "watch", "create" ]
   - apiGroups: [ "" ]
     resources: [ "pods" ]
     verbs: [ "get", "list", "watch" ]
@@ -22,4 +25,4 @@ rules:
     verbs: [ "get"]
   - apiGroups: [ "security.istio.io" ]
     resources: [ "authorizationpolicies" ]
-    verbs: [ "get", "list", "watch", "delete", "create", "update", "patch" ]
+    verbs: [ "get", "list", "watch", "create" ]