diff --git a/charts/authz/templates/rbac.yaml b/charts/authz/templates/rbac.yaml
index 0c677f0cb..2bea2fa47 100644
--- a/charts/authz/templates/rbac.yaml
+++ b/charts/authz/templates/rbac.yaml
@@ -14,7 +14,7 @@ metadata:
     {{- . | nindent 4 }}
   {{- end }}
 rules:
-  - apiGroups: ["greenhouse.sap"]
+  - apiGroups: ["greenhouse.sap", "shoot-grafter.cloudoperators.dev"]
     resources: ["*"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
diff --git a/dev-env/webhook/structured-authz-insecure.yaml b/dev-env/webhook/structured-authz-insecure.yaml
index 506153a76..f714f6851 100644
--- a/dev-env/webhook/structured-authz-insecure.yaml
+++ b/dev-env/webhook/structured-authz-insecure.yaml
@@ -32,7 +32,7 @@ authorizers:
       matchConditions:
         - expression: has(request.resourceAttributes) # only resource requests
         - expression: request.resourceAttributes.namespace != ""
-        - expression: request.resourceAttributes.group == "greenhouse.sap"
+        - expression: request.resourceAttributes.group in ["greenhouse.sap", "shoot-grafter.cloudoperators.dev"]
         # Note on verbs: get is needed for kubectl edit; watch is still needed for kubectl wait triggered after kubectl delete.
         # List is intentionally not matched here and should be handled via RBAC instead.
         - expression: request.resourceAttributes.verb in ["get","watch","update","patch","delete"]
diff --git a/dev-env/webhook/structured-authz-secure.yaml b/dev-env/webhook/structured-authz-secure.yaml
index a7cf7c856..eb9c53fc3 100644
--- a/dev-env/webhook/structured-authz-secure.yaml
+++ b/dev-env/webhook/structured-authz-secure.yaml
@@ -32,7 +32,7 @@ authorizers:
       matchConditions:
         - expression: has(request.resourceAttributes) # only resource requests
         - expression: request.resourceAttributes.namespace != ""
-        - expression: request.resourceAttributes.group == "greenhouse.sap"
+        - expression: request.resourceAttributes.group in ["greenhouse.sap", "shoot-grafter.cloudoperators.dev"]
         # Note on verbs: get is needed for kubectl edit; watch is still needed for kubectl wait triggered after kubectl delete.
         # List is intentionally not matched here and should be handled via RBAC instead.
         - expression: request.resourceAttributes.verb in ["get","watch","update","patch","delete"]