diff --git a/.dockerignore b/.dockerignore
index a36f222..44a26d3 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -2,11 +2,17 @@
 # Ignore everything by default and re-include only needed files
 **
 
-# Re-include Go source files (but not *_test.go)
-# If you use Podman, re-include your source directories by name,
-# such as !cmd, !api, and !internal.
-# See https://github.com/containers/buildah/issues/6417
-!**/*.go
+# Re-include Go source files (but not *_test.go). This tool chain builds
+# with podman (confirmed 2026-10-01: kind/docker here are podman-backed),
+# so the generic !**/*.go pattern the scaffold warns about doesn't actually
+# work -- buildah/containers#6417, which this comment already predicted --
+# and `docker build` here silently built from an empty source tree
+# ("package cmd/main.go is not in std") until this was pinned down.
+# Re-including directories by name, as the scaffold's own comment suggested
+# doing if this happened, is what actually works.
+!cmd
+!api
+!internal
 **/*_test.go
 
 # Re-include Go module files
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index bcb14fe..cfa880a 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -37,6 +37,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - events.k8s.io
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
 - apiGroups:
   - terdut.ryuvia.com
   resources:
diff --git a/internal/controller/terdutserver_controller.go b/internal/controller/terdutserver_controller.go
index 19cabca..107a505 100644
--- a/internal/controller/terdutserver_controller.go
+++ b/internal/controller/terdutserver_controller.go
@@ -98,6 +98,7 @@ type TerdutServerReconciler struct {
 // +kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=acid.zalan.do,resources=postgresqls,verbs=get;list;watch
+// +kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch
 
 func (r *TerdutServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := logf.FromContext(ctx)