diff --git a/src/main/resources/extensions/store-role-template.yaml b/src/main/resources/extensions/store-role-template.yaml
new file mode 100644
index 0000000..17c3888
--- /dev/null
+++ b/src/main/resources/extensions/store-role-template.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1alpha1
+kind: "Role"
+metadata:
+  name: role-template-manage-appstore
+  labels:
+    halo.run/role-template: "true"
+  annotations:
+    rbac.authorization.halo.run/module: "Appstore Management"
+    rbac.authorization.halo.run/display-name: "Appstore Management"
+    rbac.authorization.halo.run/ui-permissions: |
+      ["system:appstore:manage"]
+    rbac.authorization.halo.run/dependencies: |
+      [ \"role-template-manage-plugins\", \"role-template-manage-themes\" ]
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "secret" ]
+    resourceNames: [ "halo-run-app-store-pat-secret" ]
+    verbs: [ "create", "update", "get", "delete" ]
\ No newline at end of file