diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml
index 688df32..48a36a6 100644
--- a/config/crd/kustomization.yaml
+++ b/config/crd/kustomization.yaml
@@ -8,6 +8,9 @@ resources:
 - bases/infrastructure.cluster.x-k8s.io_incusmachinetemplates.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
+commonLabels:
+  cluster.x-k8s.io/v1beta1: v1alpha1
+
 patches:
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
 # patches here are for enabling the conversion webhook for each CRD
diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml
index 03407ce..00ef54a 100644
--- a/config/default/kustomization.yaml
+++ b/config/default/kustomization.yaml
@@ -1,5 +1,5 @@
 # Adds namespace to all resources.
-namespace: cluster-api-provider-incus-system
+namespace: capincus-system
 
 # Value of this field is prepended to the
 # names of all resources, e.g. a deployment named
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index e1654bd..4176a4f 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -4,11 +4,20 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - cluster.x-k8s.io
   resources:
   - clusters
   - machines
+  - machinesets
   verbs:
   - get
   - list
diff --git a/internal/controller/incusmachine_controller.go b/internal/controller/incusmachine_controller.go
index d588d97..03aaf6b 100644
--- a/internal/controller/incusmachine_controller.go
+++ b/internal/controller/incusmachine_controller.go
@@ -55,6 +55,8 @@ type IncusMachineReconciler struct {
 // +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=incusmachines/finalizers,verbs=update
 // +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters,verbs=get;list;watch
 // +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines,verbs=get;list;watch
+// +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machinesets,verbs=get;list;watch
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
@@ -153,7 +155,9 @@ func (r *IncusMachineReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	// Note: Finalizers in general can only be added when the deletionTimestamp is not set.
 	if incusMachine.ObjectMeta.DeletionTimestamp.IsZero() && !controllerutil.ContainsFinalizer(incusMachine, infrav1alpha1.MachineFinalizer) {
 		controllerutil.AddFinalizer(incusMachine, infrav1alpha1.MachineFinalizer)
-		return ctrl.Result{}, nil
+		return ctrl.Result{
+			Requeue: true,
+		}, nil
 	}
 
 	// Handle deleted machines