diff --git a/apis/proxyserver/v1alpha1/openapi_generated.go b/apis/proxyserver/v1alpha1/openapi_generated.go
index 18d0d364..72d005a7 100644
--- a/apis/proxyserver/v1alpha1/openapi_generated.go
+++ b/apis/proxyserver/v1alpha1/openapi_generated.go
@@ -19693,8 +19693,9 @@ func schema_kmodulesxyz_client_go_api_v1_ClusterClaimFeatures(ref common.Referen
 				Properties: map[string]spec.Schema{
 					"enabledFeatures": {
 						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
+							Type: []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
 								Schema: &spec.Schema{
 									SchemaProps: spec.SchemaProps{
 										Default: "",
diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
index f2654b8f..54883d58 100644
--- a/pkg/apiserver/apiserver.go
+++ b/pkg/apiserver/apiserver.go
@@ -48,6 +48,8 @@ import (
 	"k8s.io/klog/v2"
 	cu "kmodules.xyz/client-go/client"
 	clustermeta "kmodules.xyz/client-go/cluster"
+	addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
+	addonv1beta1 "open-cluster-management.io/api/addon/v1beta1"
 	clusterv1alpha1 "open-cluster-management.io/api/cluster/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
@@ -70,6 +72,8 @@ func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(Scheme))
 	utilruntime.Must(clusterv1alpha1.Install(Scheme))
 	utilruntime.Must(core.AddToScheme(Scheme))
+	utilruntime.Must(addonv1alpha1.Install(Scheme))
+	utilruntime.Must(addonv1beta1.Install(Scheme))
 
 	// we need to add the options to empty v1
 	// TODO fix the server code to avoid this
diff --git a/pkg/manager/agent-manifests/license-proxyserver/Chart.yaml b/pkg/manager/agent-manifests/license-proxyserver/Chart.yaml
index 6fba4e76..79464379 100755
--- a/pkg/manager/agent-manifests/license-proxyserver/Chart.yaml
+++ b/pkg/manager/agent-manifests/license-proxyserver/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 description: Kubernetes license-proxyserver by AppsCode
 name: license-proxyserver
 version: v2026.1.15
-appVersion: v0.0.26
+appVersion: v0.1.0
 home: https://github.com/appscode-cloud/license-proxyserver
 icon: https://cdn.appscode.com/images/products/searchlight/icons/android-icon-192x192.png
 sources:
diff --git a/pkg/manager/manager.go b/pkg/manager/manager.go
index fe1b1faf..d780ded3 100644
--- a/pkg/manager/manager.go
+++ b/pkg/manager/manager.go
@@ -44,6 +44,7 @@ import (
 	"open-cluster-management.io/api/addon/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
@@ -52,11 +53,11 @@ import (
 //go:embed all:agent-manifests
 var FS embed.FS
 
-func NewRegistrationOption(kubeConfig *rest.Config, addonName, agentName string) *agent.RegistrationOption {
+func NewRegistrationOption(restConfig *rest.Config, kc client.Client, addonName, agentName string) *agent.RegistrationOption {
 	return &agent.RegistrationOption{
 		CSRConfigurations: agent.KubeClientSignerConfigurations(addonName, agentName),
 		CSRApproveCheck:   agent.ApprovalAllCSRs,
-		PermissionConfig:  rbac.SetupPermission(kubeConfig, agentName),
+		PermissionConfig:  rbac.SetupPermission(restConfig, kc, agentName),
 		AgentInstallNamespace: func(addon *v1alpha1.ManagedClusterAddOn) (string, error) {
 			return common.AddonInstallationNamespace, nil
 		},
@@ -140,7 +141,7 @@ func runManagerController(ctx context.Context, cfg *rest.Config, opts *ManagerOp
 		os.Exit(1)
 	}
 
-	registrationOption := NewRegistrationOption(cfg, common.AddonName, common.AgentName)
+	registrationOption := NewRegistrationOption(cfg, hubManager.GetClient(), common.AddonName, common.AgentName)
 
 	addonManager, err := addonmanager.New(cfg)
 	if err != nil {
diff --git a/pkg/manager/rbac/rbac.go b/pkg/manager/rbac/rbac.go
index ea16b0b2..f5605e70 100644
--- a/pkg/manager/rbac/rbac.go
+++ b/pkg/manager/rbac/rbac.go
@@ -19,6 +19,8 @@ package rbac
 import (
 	"context"
 
+	"go.bytebuilders.dev/license-proxyserver/pkg/common"
+
 	rbacv1 "k8s.io/api/rbac/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -27,12 +29,14 @@ import (
 	"k8s.io/utils/ptr"
 	"open-cluster-management.io/addon-framework/pkg/agent"
 	addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
+	addonv1beta1 "open-cluster-management.io/api/addon/v1beta1"
 	clusterv1 "open-cluster-management.io/api/cluster/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-func SetupPermission(kubeConfig *rest.Config, agentName string) agent.PermissionConfigFunc {
+func SetupPermission(restConfig *rest.Config, kc client.Client, agentName string) agent.PermissionConfigFunc {
 	return func(cluster *clusterv1.ManagedCluster, addon *addonv1alpha1.ManagedClusterAddOn) error {
-		nativeClient, err := kubernetes.NewForConfig(kubeConfig)
+		nativeClient, err := kubernetes.NewForConfig(restConfig)
 		if err != nil {
 			return err
 		}
@@ -81,12 +85,28 @@ func SetupPermission(kubeConfig *rest.Config, agentName string) agent.Permission
 			},
 			Subjects: []rbacv1.Subject{
 				{
-					Kind: rbacv1.UserKind,
-					Name: agentUser,
+					Kind: "ServiceAccount",
+					Name: common.AddonName + "-agent",
 				},
 			},
 		}
 
+		managedClusterAddon := &addonv1beta1.ManagedClusterAddOn{}
+		if err := kc.Get(context.TODO(), client.ObjectKey{Namespace: namespace, Name: addon.Name}, managedClusterAddon); err != nil {
+			return err
+		}
+
+		for _, reg := range managedClusterAddon.Status.Registrations {
+			if reg.Type == addonv1beta1.KubeClient && reg.KubeClient.Driver == "csr" {
+				roleBinding.Subjects = []rbacv1.Subject{
+					{
+						Kind: "User",
+						Name: agentUser,
+					},
+				}
+			}
+		}
+
 		_, err = nativeClient.RbacV1().Roles(cluster.Name).Get(context.TODO(), role.Name, metav1.GetOptions{})
 		switch {
 		case apierrors.IsNotFound(err):