diff --git a/.changeset/eleven-bats-tease.md b/.changeset/eleven-bats-tease.md
index 38c591ea3c..400a0fb722 100644
--- a/.changeset/eleven-bats-tease.md
+++ b/.changeset/eleven-bats-tease.md
@@ -2,4 +2,4 @@
 '@backstage/plugin-kubernetes-backend': minor
 ---
 
-PermissionApi of type PermissionEvaluator must now be passed as a parameter when calling proxy.createRequestHandler() for the KubernetesProxyEndpoint. Kubernetes `/proxy` endpoint now requires two tokens in its header per request.The field `X-Kubernetes-Authentication` needs the value of a authentication authorities' bearer token.The field `Authorization` should contain a backstage identity token.
+`KubernetesBuilder.create` now requires a `permissions` field of type `PermissionEvaluator`. The kubernetes `/proxy` endpoint now requires two tokens: the `X-Kubernetes-Authorization` header should contain a bearer token for the target cluster, and the `Authorization` header should contain a backstage identity token.
diff --git a/docs/features/kubernetes/installation.md b/docs/features/kubernetes/installation.md
index ae7826a804..17028ef90f 100644
--- a/docs/features/kubernetes/installation.md
+++ b/docs/features/kubernetes/installation.md
@@ -75,6 +75,7 @@ export default async function createPlugin(
     logger: env.logger,
     config: env.config,
     catalogApi,
+    permissions: env.permissions,
   }).build();
   return router;
 }
diff --git a/plugins/kubernetes-backend/src/service/KubernetesProxy.ts b/plugins/kubernetes-backend/src/service/KubernetesProxy.ts
index 8e9f27d994..59d209d93a 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesProxy.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesProxy.ts
@@ -23,10 +23,7 @@ import {
   serializeError,
 } from '@backstage/errors';
 import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
-import {
-  kubernetesProxyReadPermission,
-  kubernetesProxyCreatePermission,
-} from '@backstage/plugin-kubernetes-common';
+import { kubernetesProxyPermission } from '@backstage/plugin-kubernetes-common';
 import {
   PermissionEvaluator,
   AuthorizeResult,
@@ -76,10 +73,7 @@ export class KubernetesProxy {
 
       const authorizeResponse = (
         await permissionApi.authorize(
-          [
-            { permission: kubernetesProxyReadPermission },
-            { permission: kubernetesProxyCreatePermission },
-          ],
+          [{ permission: kubernetesProxyPermission }],
           {
             token,
           },
diff --git a/plugins/kubernetes-common/src/index.ts b/plugins/kubernetes-common/src/index.ts
index 6aab437cd1..88b600f17b 100644
--- a/plugins/kubernetes-common/src/index.ts
+++ b/plugins/kubernetes-common/src/index.ts
@@ -23,7 +23,6 @@
 export * from './types';
 export * from './catalog-entity-constants';
 export {
-  kubernetesProxyReadPermission,
-  kubernetesProxyCreatePermission,
+  kubernetesProxyPermission,
   kubernetesClusterPermissions,
 } from './permissions';
diff --git a/plugins/kubernetes-common/src/permissions.ts b/plugins/kubernetes-common/src/permissions.ts
index 854a188506..58eb47fbf3 100644
--- a/plugins/kubernetes-common/src/permissions.ts
+++ b/plugins/kubernetes-common/src/permissions.ts
@@ -16,27 +16,16 @@
 
 import { createPermission } from '@backstage/plugin-permission-common';
 
-/** This permission is used to authorize `read` actions that involve using the kubernetes Proxy Endpoint /proxy
+/** This permission is used to check access to the proxy endpoint
  * @alpha
  */
-export const kubernetesProxyReadPermission = createPermission({
-  name: 'kubernetes.proxy.read',
-  attributes: { action: 'read' },
-});
-
-/** This permission is used to authorize `create` actions that involve using the kubernetes Proxy Endpoint /proxy
- * @alpha
- */
-export const kubernetesProxyCreatePermission = createPermission({
-  name: 'kubernetes.proxy.create',
-  attributes: { action: 'create' },
+export const kubernetesProxyPermission = createPermission({
+  name: 'kubernetes.proxy',
+  attributes: {},
 });
 
 /**
  * List of all cluster permissions.
  * @alpha
  */
-export const kubernetesClusterPermissions = [
-  kubernetesProxyReadPermission,
-  kubernetesProxyCreatePermission,
-];
+export const kubernetesClusterPermissions = [kubernetesProxyPermission];