diff --git a/gitops/tenants/project.yaml b/gitops/tenants/project.yaml
index 8f2dded..81f9cfc 100644
--- a/gitops/tenants/project.yaml
+++ b/gitops/tenants/project.yaml
@@ -9,7 +9,11 @@ spec:
   destinations:
     - server: https://kubernetes.default.svc
       namespace: 'tenant-*'
-  clusterResourceWhitelist: []   # tenants can't touch cluster-scoped resources
+
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'