diff --git a/registry-public/package.yaml b/registry-public/package.yaml
index da060f6fc..180eb8e8a 100644
--- a/registry-public/package.yaml
+++ b/registry-public/package.yaml
@@ -1,5 +1,5 @@
 name: registry-public
-version: '4.33.2'
+version: '4.33.3'
 synopsis: Registry Public
 description: Registry Public
 category: Web
diff --git a/registry-server/package.yaml b/registry-server/package.yaml
index ff11bfce0..03721be6c 100644
--- a/registry-server/package.yaml
+++ b/registry-server/package.yaml
@@ -1,5 +1,5 @@
 name: registry-server
-version: '4.33.2'
+version: '4.33.3'
 synopsis: Engine Registry
 description: Engine Registry
 category: Web
diff --git a/registry-server/src/Registry/Api/Handler/Swagger/Api.hs b/registry-server/src/Registry/Api/Handler/Swagger/Api.hs
index fc3bc9e8d..02f502fef 100644
--- a/registry-server/src/Registry/Api/Handler/Swagger/Api.hs
+++ b/registry-server/src/Registry/Api/Handler/Swagger/Api.hs
@@ -41,7 +41,7 @@ swagger =
             s._swaggerInfo
               { _infoTitle = "Registry API"
               , _infoDescription = Just "API specification for Registry"
-              , _infoVersion = "4.33.2"
+              , _infoVersion = "4.33.3"
               , _infoLicense =
                   Just $
                     License
diff --git a/shared-common/package.yaml b/shared-common/package.yaml
index 2037074cb..d5082d900 100644
--- a/shared-common/package.yaml
+++ b/shared-common/package.yaml
@@ -1,5 +1,5 @@
 name: shared-common
-version: '4.33.2'
+version: '4.33.3'
 synopsis: Engine Shared
 description: Engine Shared
 category: Web
diff --git a/wizard-public/package.yaml b/wizard-public/package.yaml
index 3c66a039b..09202393f 100644
--- a/wizard-public/package.yaml
+++ b/wizard-public/package.yaml
@@ -1,5 +1,5 @@
 name: wizard-public
-version: '4.33.2'
+version: '4.33.3'
 synopsis: Wizard Public
 description: Wizard Public
 category: Web
diff --git a/wizard-public/src/WizardLib/Public/Model/PersistentCommand/Tenant/CreateTenantCommand.hs b/wizard-public/src/WizardLib/Public/Model/PersistentCommand/Tenant/CreateTenantCommand.hs
index 4ae14a490..2a0e49ef8 100644
--- a/wizard-public/src/WizardLib/Public/Model/PersistentCommand/Tenant/CreateTenantCommand.hs
+++ b/wizard-public/src/WizardLib/Public/Model/PersistentCommand/Tenant/CreateTenantCommand.hs
@@ -14,6 +14,7 @@ data CreateTenantCommand = CreateTenantCommand
   , enabled :: Bool
   , customDomain :: Maybe String
   , adminRoleUuid :: U.UUID
+  , adminRolePermissions :: [String]
   , limits :: TenantLimitBundleChange
   }
   deriving (Show, Eq, Generic)
diff --git a/wizard-server/package.yaml b/wizard-server/package.yaml
index 0ec565fc3..996923ac5 100644
--- a/wizard-server/package.yaml
+++ b/wizard-server/package.yaml
@@ -1,5 +1,5 @@
 name: wizard-server
-version: '4.33.2'
+version: '4.33.3'
 synopsis: Engine Wizard
 description: Engine Wizard
 category: Web
diff --git a/wizard-server/src/Wizard/Api/Handler/Swagger/Api.hs b/wizard-server/src/Wizard/Api/Handler/Swagger/Api.hs
index 2fe2d9323..e37be04f2 100644
--- a/wizard-server/src/Wizard/Api/Handler/Swagger/Api.hs
+++ b/wizard-server/src/Wizard/Api/Handler/Swagger/Api.hs
@@ -158,7 +158,7 @@ swagger =
             s._swaggerInfo
               { _infoTitle = "Wizard API"
               , _infoDescription = Just "API specification for Wizard"
-              , _infoVersion = "4.33.2"
+              , _infoVersion = "4.33.3"
               , _infoLicense =
                   Just $
                     License
diff --git a/wizard-server/src/Wizard/Service/Tenant/TenantService.hs b/wizard-server/src/Wizard/Service/Tenant/TenantService.hs
index ed98ab774..1128125dc 100644
--- a/wizard-server/src/Wizard/Service/Tenant/TenantService.hs
+++ b/wizard-server/src/Wizard/Service/Tenant/TenantService.hs
@@ -114,7 +114,7 @@ createTenantByCommand command = do
   serverConfig <- asks serverConfig
   let tenant = fromCreateCommand command NotSeededTenantState serverConfig now now
   insertTenant tenant
-  adminRole <- createAdminRoleWithUuid command.adminRoleUuid tenant.uuid now
+  adminRole <- createAdminRoleWithUuid command.adminRoleUuid tenant.uuid command.adminRolePermissions now
   createConfig tenant.uuid adminRole.uuid now
   createLimitBundle tenant.uuid now
   createLocale tenant.uuid now
@@ -166,15 +166,15 @@ deleteTenant uuid = do
 createAdminRole :: U.UUID -> UTCTime -> AppContextM Role
 createAdminRole tenantUuid now = do
   uuid <- liftIO generateUuid
-  createAdminRoleWithUuid uuid tenantUuid now
+  createAdminRoleWithUuid uuid tenantUuid allRolePermissions now
 
-createAdminRoleWithUuid :: U.UUID -> U.UUID -> UTCTime -> AppContextM Role
-createAdminRoleWithUuid uuid tenantUuid now = do
+createAdminRoleWithUuid :: U.UUID -> U.UUID -> [String] -> UTCTime -> AppContextM Role
+createAdminRoleWithUuid uuid tenantUuid permissions now = do
   let role =
         Role
           { uuid = uuid
           , name = "Admin"
-          , permissions = allRolePermissions
+          , permissions = permissions
           , isAdmin = True
           , tenantUuid = tenantUuid
           , createdAt = now