diff --git a/test/project-wrapper/sdk/util.go b/test/project-wrapper/sdk/util.go
index 796e3aeb..5db3a38b 100644
--- a/test/project-wrapper/sdk/util.go
+++ b/test/project-wrapper/sdk/util.go
@@ -8,6 +8,7 @@ import (
 var ServiceAccountRoles = []string{
 	"iaas.isolated-network.admin", // required by the infra controller
 	"iaas.network.admin",          // required by the infra controller
+	"nlb.admin",                   // required by the SelfHostedShootExposure controller
 }
 
 func GetMembersForRoles(subject string, roles set.Set[string]) []authorization.Member {