diff --git a/modules/karpenter/controller_iam.tf b/modules/karpenter/controller_iam.tf
index 9761714..a4d1bae 100644
--- a/modules/karpenter/controller_iam.tf
+++ b/modules/karpenter/controller_iam.tf
@@ -244,7 +244,7 @@ data "aws_iam_policy_document" "karpenter_controller" {
   statement {
     sid       = "AllowPassingInstanceRole"
     effect    = "Allow"
-    resources = [aws_iam_role.karpenter_node.arn]
+    resources = concat([aws_iam_role.karpenter_node.arn], var.additional_node_role_arns)
     actions   = ["iam:PassRole"]
 
     condition {
diff --git a/modules/karpenter/variables.tf b/modules/karpenter/variables.tf
index 4f4a9eb..9b55d28 100644
--- a/modules/karpenter/variables.tf
+++ b/modules/karpenter/variables.tf
@@ -16,3 +16,15 @@ variable "oidc_config" {
     arn = string
   })
 }
+
+variable "additional_node_role_arns" {
+  description = <<-EOF
+    Additional Node Role ARNS that karpenter should manage
+
+    This can be used where karpenter is using existing node
+    roles, and you want to transition to the namespaced role
+    created by this module
+  EOF
+  type        = list(string)
+  default     = []
+}