diff --git a/README.md b/README.md
index c276c99..65e0ee6 100644
--- a/README.md
+++ b/README.md
@@ -21,11 +21,7 @@ kubectl config current-context
 
 ## Install SpinKube
 ```bash
-helm install spinkube .
-
-# wait for the pods to be ready
-
-kubectl apply -f spin-operator.shim-executor.yaml
+helm install --wait spinkube .
 ```
 
 ## Deploy a Spin App
diff --git a/spin-executor.post-install-job.yaml b/spin-executor.post-install-job.yaml
deleted file mode 100644
index a6c9618..0000000
--- a/spin-executor.post-install-job.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# https://github.com/jpflueger/spinkube-oneclick/blob/main/templates/shimexecutor-post-install-job.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: "{{ .Release.Name }}-post-install"
-  labels:
-    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    app.kubernetes.io/instance: {{ .Release.Name | quote }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-  annotations:
-    "helm.sh/hook": post-install
-    "helm.sh/hook-weight": "-5"
-    "helm.sh/hook-delete-policy": hook-succeeded
-spec:
-  template:
-    metadata:
-      name: "{{ .Release.Name }}"
-      labels:
-        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-        app.kubernetes.io/instance: {{ .Release.Name | quote }}
-        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    spec:
-      restartPolicy: Never
-      containers:
-      - name: post-install-job
-        image: "bitnami/kubectl:1.30.0"
-        imagePullPolicy: IfNotPresent
-        command: ["/bin/sh", "-c"]
-        args:
-          - |-
-              cat <<EOF | kubectl apply -f -
-              apiVersion: core.spinoperator.dev/v1alpha1
-              kind: SpinAppExecutor
-              metadata:
-                name: containerd-shim-spin
-              spec:
-                createDeployment: true
-                deploymentConfig:
-                  runtimeClassName: wasmtime-spin-v2
-              EOF
diff --git a/spin-operator.shim-executor.yaml b/spin-operator.shim-executor.yaml
deleted file mode 100644
index abf3bec..0000000
--- a/spin-operator.shim-executor.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: core.spinoperator.dev/v1alpha1
-kind: SpinAppExecutor
-metadata:
-  name: containerd-shim-spin
-  annotations:
-    "helm.sh/hook": post-install
-spec:
-  createDeployment: true
-  deploymentConfig:
-    runtimeClassName: wasmtime-spin-v2
diff --git a/templates/shimexecutor-post-install-job.yaml b/templates/shimexecutor-post-install-job.yaml
new file mode 100644
index 0000000..ab14139
--- /dev/null
+++ b/templates/shimexecutor-post-install-job.yaml
@@ -0,0 +1,98 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-post-install"
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    metadata:
+      name: "{{ .Release.Name }}"
+      labels:
+        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+        app.kubernetes.io/instance: {{ .Release.Name | quote }}
+        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ .Release.Name }}-post-install
+      containers:
+      - name: post-install-job
+        image: "bitnami/kubectl:1.30.0"
+        imagePullPolicy: IfNotPresent
+        command: ["/bin/sh", "-c"]
+        args:
+          - |-
+              cat <<EOF | kubectl apply -f -
+              apiVersion: core.spinoperator.dev/v1alpha1
+              kind: SpinAppExecutor
+              metadata:
+                name: containerd-shim-spin
+                namespace: default
+              spec:
+                createDeployment: true
+                deploymentConfig:
+                  runtimeClassName: wasmtime-spin-v2
+              EOF
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-post-install
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-post-install-role
+  namespace: default
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+rules:
+- apiGroups:
+  - core.spinoperator.dev
+  resources:
+  - spinappexecutors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: '{{ .Release.Name }}-post-install-rolebinding'
+  namespace: default
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/instance: {{ .Release.Name | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: '{{ .Release.Name }}-post-install-role'
+subjects:
+- kind: ServiceAccount
+  name: '{{ .Release.Name }}-post-install'
+  namespace: '{{ .Release.Namespace }}'
\ No newline at end of file