diff --git a/chart/templates/serviceaccount.yaml b/chart/templates/serviceaccount.yaml
index 72e9cdf..7b4f606 100644
--- a/chart/templates/serviceaccount.yaml
+++ b/chart/templates/serviceaccount.yaml
@@ -130,6 +130,21 @@ rules:
       - services
     verbs:
       - delete
+  {{- if .Values.services.icc.features.skew_protection.manage_mode }}
+  # Skew protection manage mode (opt-in): ICC creates versioned Deployments and
+  # Services. Only granted when features.skew_protection.manage_mode is true;
+  # observe/advise modes never need it (advise applies via the external actor).
+  - apiGroups:
+      - ""
+      - apps
+    resources:
+      - deployments
+      - services
+    verbs:
+      - create
+      - update
+      - patch
+  {{- end }}
   # Gateway API - for skew protection (opt-in)
   - apiGroups:
       - gateway.networking.k8s.io
diff --git a/chart/values.yaml b/chart/values.yaml
index 8498560..4856e4b 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -83,6 +83,7 @@ services:
         enable: false
       skew_protection:
         enable: false
+        manage_mode: false                   # Grant ICC create/update/patch on Deployments+Services (manage-mode deploys). Off = least privilege
         auto_cleanup: false                  # Delete expired Deployment and Service resources
         http_grace_period_ms: 1800000        # Min time to keep HTTP version draining (30 min)
         http_max_alive_ms: 86400000          # Hard deadline for HTTP versions (24h)