diff --git a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
index 2137688f4..6a80ed2e3 100644
--- a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
+++ b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
@@ -18,9 +18,13 @@ spec:
     kind: GCPProviderSpec
     permissions:
     - "compute.addresses.create"
+    - "compute.addresses.createInternal"
     - "compute.addresses.delete"
+    - "compute.addresses.deleteInternal"
     - "compute.addresses.get"
     - "compute.addresses.list"
+    - "compute.addresses.use"
+    - "compute.addresses.useInternal"
     - "compute.firewalls.create"
     - "compute.firewalls.delete"
     - "compute.firewalls.get"
@@ -32,25 +36,34 @@ spec:
     - "compute.healthChecks.delete"
     - "compute.healthChecks.get"
     - "compute.healthChecks.update"
+    - "compute.healthChecks.useReadOnly"
     - "compute.httpHealthChecks.create"
     - "compute.httpHealthChecks.delete"
     - "compute.httpHealthChecks.get"
     - "compute.httpHealthChecks.update"
+    - "compute.httpHealthChecks.useReadOnly"
     - "compute.instanceGroups.create"
     - "compute.instanceGroups.delete"
     - "compute.instanceGroups.get"
+    - "compute.instanceGroups.list"
     - "compute.instanceGroups.update"
+    - "compute.instanceGroups.use"
     - "compute.instances.get"
+    - "compute.instances.list"
     - "compute.instances.use"
+    - "compute.networks.updatePolicy"
     - "compute.regionBackendServices.create"
     - "compute.regionBackendServices.delete"
     - "compute.regionBackendServices.get"
     - "compute.regionBackendServices.update"
+    - "compute.regionBackendServices.use"
+    - "compute.subnetworks.use"
     - "compute.targetPools.addInstance"
     - "compute.targetPools.create"
     - "compute.targetPools.delete"
     - "compute.targetPools.get"
     - "compute.targetPools.removeInstance"
+    - "compute.targetPools.use"
     - "compute.zones.list"
 
     # If set to true, don't check whether the requested
diff --git a/pkg/cloud/gcp/assets/cloud-controller-manager.yaml b/pkg/cloud/gcp/assets/cloud-controller-manager.yaml
index f28ce5ec8..223a55ad4 100644
--- a/pkg/cloud/gcp/assets/cloud-controller-manager.yaml
+++ b/pkg/cloud/gcp/assets/cloud-controller-manager.yaml
@@ -117,6 +117,9 @@ spec:
             - name: trusted-ca
               mountPath: /etc/pki/ca-trust/extracted/pem
               readOnly: true
+            - name: bound-sa-token
+              mountPath: /var/run/secrets/openshift/serviceaccount
+              readOnly: true
       volumes:
         - name: config-gccm
           configMap:
@@ -137,3 +140,9 @@ spec:
             items:
               - key: ca-bundle.crt
                 path: tls-ca-bundle.pem
+        - name: bound-sa-token
+          projected:
+            sources:
+            - serviceAccountToken:
+                path: token
+                audience: openshift