diff --git a/k8s/tekton/ci-rbac.yaml b/k8s/tekton/ci-rbac.yaml
new file mode 100644
index 0000000..81ca0de
--- /dev/null
+++ b/k8s/tekton/ci-rbac.yaml
@@ -0,0 +1,51 @@
+# ServiceAccount and RBAC for CI runner to create/watch Tekton PipelineRuns.
+# Applied to the `api` namespace where PipelineRuns execute.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+  labels:
+    app: api-gateway
+    component: ci
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+rules:
+- apiGroups: ["tekton.dev"]
+  resources: ["pipelineruns"]
+  verbs: ["create", "get", "list", "watch", "delete"]
+- apiGroups: ["tekton.dev"]
+  resources: ["taskruns"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+roleRef:
+  kind: Role
+  name: ci-tekton-trigger
+  apiGroup: rbac.authorization.k8s.io
+---
+# Secret to generate a long-lived token for the CI runner.
+# The runner mounts this as KUBECONFIG_B64 or uses it directly.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-tekton-trigger-token
+  namespace: api
+  annotations:
+    kubernetes.io/service-account.name: ci-tekton-trigger
+type: kubernetes.io/service-account-token
diff --git a/k8s/tekton/kustomization.yaml b/k8s/tekton/kustomization.yaml
index fefd3fd..917e24c 100644
--- a/k8s/tekton/kustomization.yaml
+++ b/k8s/tekton/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: api
 
 resources:
+- ci-rbac.yaml
 - task-integration-test.yaml
 - pipeline-integration-test.yaml