diff --git a/.changeset/tame-carpets-smell.md b/.changeset/tame-carpets-smell.md
new file mode 100644
index 0000000000..099e720783
--- /dev/null
+++ b/.changeset/tame-carpets-smell.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes': patch
+---
+
+Changed Gcloud auth scope to read-only
diff --git a/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts b/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts
index 5652549b8a..fbce644a89 100644
--- a/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts
+++ b/plugins/kubernetes/src/kubernetes-auth-provider/GoogleKubernetesAuthProvider.ts
@@ -39,7 +39,7 @@ export class GoogleKubernetesAuthProvider implements KubernetesAuthProvider {
   async getCredentials(): Promise<{ token: string }> {
     return {
       token: await this.authProvider.getAccessToken(
-        'https://www.googleapis.com/auth/cloud-platform',
+        'https://www.googleapis.com/auth/cloud-platform.read-only',
       ),
     };
   }