diff --git a/pkg/webhook/cluster_roles.go b/pkg/webhook/cluster_roles.go
index e23dee900..ba4ccf944 100755
--- a/pkg/webhook/cluster_roles.go
+++ b/pkg/webhook/cluster_roles.go
@@ -163,6 +163,7 @@ func getSpecClusterRole() (*v1.ClusterRole, error) {
 				Verbs: []string{
 					"get",
 					"list",
+					"watch",
 				},
 			},
 			// Needed for pkg/config/sync.go:109 (SetupControllerConfig)
diff --git a/webhook/main.go b/webhook/main.go
index 02c1bc720..e6d44d4df 100644
--- a/webhook/main.go
+++ b/webhook/main.go
@@ -170,7 +170,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	err = createWebhooks(mgr)
+	err = createWebhooks(mgr, nonCachedClient)
 	if err != nil {
 		log.Error(err, "Failed to create webhooks")
 		os.Exit(1)
@@ -198,7 +198,7 @@ func main() {
 	}
 }
 
-func createWebhooks(mgr manager.Manager) error {
+func createWebhooks(mgr manager.Manager, nonCachedClient client.Client) error {
 	log.Info("Configuring Webhook Server")
 	err := server.ConfigureWebhookServer(mgr)
 	if err != nil {
@@ -206,7 +206,7 @@ func createWebhooks(mgr manager.Manager) error {
 	}
 
 	log.Info("Configuring Webhooks")
-	if err := workspace.Configure(context.TODO(), mgr); err != nil {
+	if err := workspace.Configure(context.TODO(), mgr, nonCachedClient); err != nil {
 		return err
 	}
 	return nil
diff --git a/webhook/workspace/config.go b/webhook/workspace/config.go
index b84eecc78..7ff2a0335 100644
--- a/webhook/workspace/config.go
+++ b/webhook/workspace/config.go
@@ -36,7 +36,7 @@ import (
 )
 
 // Configure configures mutate/validating webhooks that provides exec access into workspace for creator only
-func Configure(ctx context.Context, mgr manager.Manager) error {
+func Configure(ctx context.Context, mgr manager.Manager, nonCachingClient client.Client) error {
 	log.Info("Configuring devworkspace webhooks")
 	c, err := createClient()
 	if err != nil {
@@ -88,7 +88,7 @@ func Configure(ctx context.Context, mgr manager.Manager) error {
 		log.Info("Created devworkspace mutating webhook configuration")
 	}
 
-	server.GetWebhookServer().Register(mutateWebhookPath, &webhook.Admission{Handler: NewResourcesMutator(saUID, saName, mgr)})
+	server.GetWebhookServer().Register(mutateWebhookPath, &webhook.Admission{Handler: NewResourcesMutator(saUID, saName, mgr, nonCachingClient)})
 
 	if err := c.Create(ctx, validateWebhookCfg); err != nil {
 		if !apierrors.IsAlreadyExists(err) {
@@ -111,7 +111,7 @@ func Configure(ctx context.Context, mgr manager.Manager) error {
 		log.Info("Created devworkspace validating webhook configuration")
 	}
 
-	server.GetWebhookServer().Register(validateWebhookPath, &webhook.Admission{Handler: NewResourcesValidator(saUID, saName, mgr)})
+	server.GetWebhookServer().Register(validateWebhookPath, &webhook.Admission{Handler: NewResourcesValidator(saUID, saName, mgr, nonCachingClient)})
 
 	return nil
 }
diff --git a/webhook/workspace/handler/handler.go b/webhook/workspace/handler/handler.go
index a3b583b71..702f36faf 100644
--- a/webhook/workspace/handler/handler.go
+++ b/webhook/workspace/handler/handler.go
@@ -28,6 +28,7 @@ type WebhookHandler struct {
 	ControllerUID    string
 	ControllerSAName string
 	Client           client.Client
+	NonCachingClient client.Client
 	Decoder          admission.Decoder
 }
 
diff --git a/webhook/workspace/handler/workspace.go b/webhook/workspace/handler/workspace.go
index 04a840dd1..833c14e89 100644
--- a/webhook/workspace/handler/workspace.go
+++ b/webhook/workspace/handler/workspace.go
@@ -294,7 +294,7 @@ func (h *WebhookHandler) resolveDevWorkspace(
 	flattenHelpers := flatten.ResolverTools{
 		WorkspaceNamespace:          workspace.Namespace,
 		Context:                     ctx,
-		K8sClient:                   h.Client,
+		K8sClient:                   h.NonCachingClient,
 		HttpClient:                  httpClient,
 		DefaultResourceRequirements: workspace.Config.Workspace.DefaultContainerResources,
 	}
diff --git a/webhook/workspace/handler/workspace_test.go b/webhook/workspace/handler/workspace_test.go
index 73ab7225f..6f7d3f8a0 100644
--- a/webhook/workspace/handler/workspace_test.go
+++ b/webhook/workspace/handler/workspace_test.go
@@ -88,8 +88,9 @@ func newTestWebhookHandler(t *testing.T) *WebhookHandler {
 		WithScheme(s).
 		Build()
 	return &WebhookHandler{
-		Client:  fakeClient,
-		Decoder: admission.NewDecoder(s),
+		Client:           fakeClient,
+		NonCachingClient: fakeClient,
+		Decoder:          admission.NewDecoder(s),
 	}
 }
 
diff --git a/webhook/workspace/mutate.go b/webhook/workspace/mutate.go
index d3cc4e9ce..2c18381ad 100644
--- a/webhook/workspace/mutate.go
+++ b/webhook/workspace/mutate.go
@@ -19,6 +19,7 @@ import (
 	"context"
 	"fmt"
 
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 
 	"github.com/devfile/devworkspace-operator/webhook/workspace/handler"
@@ -33,8 +34,8 @@ type ResourcesMutator struct {
 	*handler.WebhookHandler
 }
 
-func NewResourcesMutator(controllerUID, controllerSAName string, mgr manager.Manager) *ResourcesMutator {
-	return &ResourcesMutator{&handler.WebhookHandler{ControllerUID: controllerUID, ControllerSAName: controllerSAName, Decoder: admission.NewDecoder(mgr.GetScheme()), Client: mgr.GetClient()}}
+func NewResourcesMutator(controllerUID, controllerSAName string, mgr manager.Manager, nonCachingClient client.Client) *ResourcesMutator {
+	return &ResourcesMutator{&handler.WebhookHandler{ControllerUID: controllerUID, ControllerSAName: controllerSAName, Decoder: admission.NewDecoder(mgr.GetScheme()), Client: mgr.GetClient(), NonCachingClient: nonCachingClient}}
 }
 
 // ResourcesMutator verify if operation is a valid from Workspace controller perspective
diff --git a/webhook/workspace/validate.go b/webhook/workspace/validate.go
index 4a38cfb90..9fdf1304d 100644
--- a/webhook/workspace/validate.go
+++ b/webhook/workspace/validate.go
@@ -19,6 +19,7 @@ import (
 	"context"
 	"fmt"
 
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 
 	"github.com/devfile/devworkspace-operator/webhook/workspace/handler"
@@ -33,8 +34,8 @@ type ResourcesValidator struct {
 	*handler.WebhookHandler
 }
 
-func NewResourcesValidator(controllerUID, controllerSAName string, mgr manager.Manager) *ResourcesValidator {
-	return &ResourcesValidator{&handler.WebhookHandler{ControllerUID: controllerUID, ControllerSAName: controllerSAName, Decoder: admission.NewDecoder(mgr.GetScheme()), Client: mgr.GetClient()}}
+func NewResourcesValidator(controllerUID, controllerSAName string, mgr manager.Manager, nonCachingClient client.Client) *ResourcesValidator {
+	return &ResourcesValidator{&handler.WebhookHandler{ControllerUID: controllerUID, ControllerSAName: controllerSAName, Decoder: admission.NewDecoder(mgr.GetScheme()), Client: mgr.GetClient(), NonCachingClient: nonCachingClient}}
 }
 
 func (v *ResourcesValidator) Handle(ctx context.Context, req admission.Request) admission.Response {