diff --git a/Makefile.reconcilermanager b/Makefile.reconcilermanager
index 7c477d281a..1c3b351477 100644
--- a/Makefile.reconcilermanager
+++ b/Makefile.reconcilermanager
@@ -30,7 +30,8 @@ configsync-crds: install-controller-gen "$(KUSTOMIZE)" "$(GOBIN)/addlicense"
 .PHONY: install-controller-gen
 # install controller-gen from source
 install-controller-gen:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.13.0
+	# TODO: use a fixed version instead of master when https://github.com/kubernetes-sigs/controller-tools/issues/851 is fixed.
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@master
 
 .PHONY: generate-in-docker
 # Run make generate-in-docker in the docker buildenv container
diff --git a/manifests/reposync-crd.yaml b/manifests/reposync-crd.yaml
index 1a2c9ca188..47b43983e1 100644
--- a/manifests/reposync-crd.yaml
+++ b/manifests/reposync-crd.yaml
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.13.1-0.20231106142007-a28b9003e012
   labels:
     configmanagement.gke.io/arch: csmr
     configmanagement.gke.io/system: "true"
diff --git a/manifests/rootsync-crd.yaml b/manifests/rootsync-crd.yaml
index b7010cdf53..d53f155984 100644
--- a/manifests/rootsync-crd.yaml
+++ b/manifests/rootsync-crd.yaml
@@ -16,7 +16,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.13.0
+    controller-gen.kubebuilder.io/version: v0.13.1-0.20231106142007-a28b9003e012
   labels:
     configmanagement.gke.io/arch: csmr
     configmanagement.gke.io/system: "true"
diff --git a/pkg/api/configsync/v1beta1/zz_generated.deepcopy.go b/pkg/api/configsync/v1beta1/zz_generated.deepcopy.go
index 04ea3b9bbf..f2d34a9ca4 100644
--- a/pkg/api/configsync/v1beta1/zz_generated.deepcopy.go
+++ b/pkg/api/configsync/v1beta1/zz_generated.deepcopy.go
@@ -10,6 +10,21 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterRoleOverrideSpec) DeepCopyInto(out *ClusterRoleOverrideSpec) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterRoleOverrideSpec.
+func (in *ClusterRoleOverrideSpec) DeepCopy() *ClusterRoleOverrideSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterRoleOverrideSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ConfigSyncError) DeepCopyInto(out *ConfigSyncError) {
 	*out = *in
@@ -599,6 +614,7 @@ func (in *RootSyncList) DeepCopyObject() runtime.Object {
 func (in *RootSyncOverrideSpec) DeepCopyInto(out *RootSyncOverrideSpec) {
 	*out = *in
 	in.OverrideSpec.DeepCopyInto(&out.OverrideSpec)
+	out.ClusterRole = in.ClusterRole
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RootSyncOverrideSpec.