diff --git a/grafana.yaml b/grafana.yaml
index b6bfc91..5d3f36d 100644
--- a/grafana.yaml
+++ b/grafana.yaml
@@ -73,7 +73,7 @@ spec:
             - name: GF_AUTH_GENERIC_OAUTH_USE_ID_TOKEN
               value: "false"
             - name: GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH
-              value: Admin
+              value: "contains(groups[*], 'github.com:codemowers:admins') && 'Admin' || 'Viewer'"
             # matches OIDCClient pkce: false
             - name: GF_AUTH_GENERIC_OAUTH_USE_PKCE
               value: "false"