diff --git a/deploy/helm/openshell/templates/clusterrole.yaml b/deploy/helm/openshell/templates/clusterrole.yaml
index eb1ed8e1d0..5d328a1261 100644
--- a/deploy/helm/openshell/templates/clusterrole.yaml
+++ b/deploy/helm/openshell/templates/clusterrole.yaml
@@ -5,7 +5,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
 rules:
diff --git a/deploy/helm/openshell/templates/clusterrolebinding.yaml b/deploy/helm/openshell/templates/clusterrolebinding.yaml
index 685a73bf91..9b3b254586 100644
--- a/deploy/helm/openshell/templates/clusterrolebinding.yaml
+++ b/deploy/helm/openshell/templates/clusterrolebinding.yaml
@@ -4,13 +4,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "openshell.serviceAccountName" . }}
diff --git a/deploy/helm/openshell/tests/clusterrole_test.yaml b/deploy/helm/openshell/tests/clusterrole_test.yaml
index afecada9b6..8f16aef584 100644
--- a/deploy/helm/openshell/tests/clusterrole_test.yaml
+++ b/deploy/helm/openshell/tests/clusterrole_test.yaml
@@ -9,6 +9,12 @@ release:
   namespace: my-namespace
 
 tests:
+  - it: includes the release namespace in the ClusterRole name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: openshell-node-reader-my-namespace
+
   - it: grants managed namespace NetworkPolicy apply permissions
     set:
       server.drivers.kubernetes.workspaceMode: managed
diff --git a/deploy/helm/openshell/tests/clusterrolebinding_test.yaml b/deploy/helm/openshell/tests/clusterrolebinding_test.yaml
new file mode 100644
index 0000000000..5b9a83c04c
--- /dev/null
+++ b/deploy/helm/openshell/tests/clusterrolebinding_test.yaml
@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+suite: ClusterRoleBinding RBAC
+templates:
+  - templates/clusterrolebinding.yaml
+release:
+  name: openshell
+  namespace: my-namespace
+
+tests:
+  - it: includes the release namespace in the ClusterRoleBinding name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: openshell-node-reader-my-namespace
+
+  - it: references the namespace-scoped ClusterRole in roleRef
+    asserts:
+      - equal:
+          path: roleRef.name
+          value: openshell-node-reader-my-namespace
+
+  - it: binds the service account in the release namespace
+    asserts:
+      - contains:
+          path: subjects
+          content:
+            kind: ServiceAccount
+            name: openshell
+            namespace: my-namespace