diff --git a/charts/nginx-ingress/README.md b/charts/nginx-ingress/README.md
index a7dcc4e056..239ed97490 100644
--- a/charts/nginx-ingress/README.md
+++ b/charts/nginx-ingress/README.md
@@ -473,6 +473,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.telemetryReporting.enable` | Enable telemetry reporting. | true |
 |`controller.enableWeightChangesDynamicReload` | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
 |`rbac.create` | Configures RBAC. | true |
+|`rbac.clusterrole.create` | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
 |`prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
 |`prometheus.port` | Configures the port to scrape the metrics. | 9113 |
 |`prometheus.scheme` | Configures the HTTP scheme to use for connections to the Prometheus endpoint. | http |
diff --git a/charts/nginx-ingress/templates/clusterrole.yaml b/charts/nginx-ingress/templates/clusterrole.yaml
index c188603921..42566f9e47 100644
--- a/charts/nginx-ingress/templates/clusterrole.yaml
+++ b/charts/nginx-ingress/templates/clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create .Values.rbac.clusterrole.create }}
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
diff --git a/charts/nginx-ingress/templates/clusterrolebiding.yaml b/charts/nginx-ingress/templates/clusterrolebinding.yaml
similarity index 100%
rename from charts/nginx-ingress/templates/clusterrolebiding.yaml
rename to charts/nginx-ingress/templates/clusterrolebinding.yaml
diff --git a/charts/nginx-ingress/templates/controller-rolebiding.yaml b/charts/nginx-ingress/templates/controller-rolebinding.yaml
similarity index 100%
rename from charts/nginx-ingress/templates/controller-rolebiding.yaml
rename to charts/nginx-ingress/templates/controller-rolebinding.yaml
diff --git a/charts/nginx-ingress/values.yaml b/charts/nginx-ingress/values.yaml
index 887ecfe7ca..3e10e200c7 100644
--- a/charts/nginx-ingress/values.yaml
+++ b/charts/nginx-ingress/values.yaml
@@ -501,6 +501,10 @@ rbac:
   ## Configures RBAC.
   create: true
 
+  clusterrole:
+    ## Create ClusterRole
+    create: true
+
 prometheus:
   ## Expose NGINX or NGINX Plus metrics in the Prometheus format.
   create: true
diff --git a/docs/content/installation/installing-nic/installation-with-helm.md b/docs/content/installation/installing-nic/installation-with-helm.md
index 0d2afde227..8958b1331b 100644
--- a/docs/content/installation/installing-nic/installation-with-helm.md
+++ b/docs/content/installation/installing-nic/installation-with-helm.md
@@ -430,6 +430,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 | **controller.telemetryReporting.enable** | Enable telemetry reporting. | true |
 | **controller.enableWeightChangesDynamicReload** | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
 | **rbac.create** | Configures RBAC. | true |
+| **rbac.clusterrole.create** | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
 | **prometheus.create** | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
 | **prometheus.port** | Configures the port to scrape the metrics. | 9113 |
 | **prometheus.scheme** | Configures the HTTP scheme to use for connections to the Prometheus endpoint. | http |