diff --git a/class/defaults.yml b/class/defaults.yml
index 18ceaf0..f090403 100644
--- a/class/defaults.yml
+++ b/class/defaults.yml
@@ -178,4 +178,4 @@ parameters:
       appuio-cloud-agent:
         registry: ghcr.io
         image: appuio/cloud-agent
-        tag: v0.10.0
+        tag: v0.11.0
diff --git a/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-2-cloud-agent.yaml b/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-2-cloud-agent.yaml
index 255c949..b6e46f1 100644
--- a/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-2-cloud-agent.yaml
+++ b/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-2-cloud-agent.yaml
@@ -8,6 +8,7 @@ rules:
   - appuio.io
   resources:
   - usageprofiles
+  - users
   verbs:
   - get
   - list
diff --git a/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_extra-zone-cloud-agent.yaml b/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_extra-zone-cloud-agent.yaml
index e5a9dca..48a901a 100644
--- a/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_extra-zone-cloud-agent.yaml
+++ b/tests/golden/defaults/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_extra-zone-cloud-agent.yaml
@@ -8,6 +8,7 @@ rules:
   - appuio.io
   resources:
   - usageprofiles
+  - users
   verbs:
   - get
   - list
diff --git a/tests/golden/insecure/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml b/tests/golden/insecure/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml
index b8c0900..d679d6e 100644
--- a/tests/golden/insecure/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml
+++ b/tests/golden/insecure/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml
@@ -8,6 +8,7 @@ rules:
   - appuio.io
   resources:
   - usageprofiles
+  - users
   verbs:
   - get
   - list
diff --git a/tests/golden/withcronjob/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml b/tests/golden/withcronjob/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml
index b8c0900..d679d6e 100644
--- a/tests/golden/withcronjob/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml
+++ b/tests/golden/withcronjob/control-api/control-api/90_cloud_agent_rbac/rbac.authorization.k8s.io_v1_clusterrole_example-zone-1-cloud-agent.yaml
@@ -8,6 +8,7 @@ rules:
   - appuio.io
   resources:
   - usageprofiles
+  - users
   verbs:
   - get
   - list