diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4ed1308..34f4d3e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,8 +9,16 @@ All notable changes to this project will be documented in this file.
 - Bump stackable-operator to 0.114.0 ([#730]).
 - Bump stackable-operator to 0.115.0 ([#735]).
 
+### Fixed
+
+- BREAKING: Honour `serviceAccount.name`, which the ServiceAccount, the controller Deployment and
+  the CSI node driver DaemonSet previously ignored in favour of a hardcoded name.
+  `serviceAccount.create=false` now requires `serviceAccount.name`; it used to fall back to the
+  namespace default ServiceAccount, which lacks the operator ClusterRole ([#736]).
+
 [#730]: https://github.com/stackabletech/secret-operator/pull/730
 [#735]: https://github.com/stackabletech/secret-operator/pull/735
+[#736]: https://github.com/stackabletech/secret-operator/pull/736
 
 ## [26.7.0] - 2026-07-21
 
diff --git a/deploy/helm/secret-operator/templates/_helpers.tpl b/deploy/helm/secret-operator/templates/_helpers.tpl
index 7d4d39da..e5354470 100644
--- a/deploy/helm/secret-operator/templates/_helpers.tpl
+++ b/deploy/helm/secret-operator/templates/_helpers.tpl
@@ -65,9 +65,9 @@ Create the name of the service account to use
 */}}
 {{- define "operator.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create }}
-{{- default (include "operator.fullname" .) .Values.serviceAccount.name }}
+{{- default (printf "%s-serviceaccount" (include "operator.fullname" .)) .Values.serviceAccount.name }}
 {{- else }}
-{{- default "default" .Values.serviceAccount.name }}
+{{- required "serviceAccount.name is required when serviceAccount.create is false, because the chart then does not create a ServiceAccount for the operator to run as." .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
 
diff --git a/deploy/helm/secret-operator/templates/controller-deployment.yaml b/deploy/helm/secret-operator/templates/controller-deployment.yaml
index a2520d3c..1ae22c27 100644
--- a/deploy/helm/secret-operator/templates/controller-deployment.yaml
+++ b/deploy/helm/secret-operator/templates/controller-deployment.yaml
@@ -27,7 +27,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       # NOTE (@Techassi): Does it maybe make sense to have two different service accounts?
-      serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount
+      serviceAccountName: {{ include "operator.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.controllerService.podSecurityContext | nindent 8 }}
       containers:
diff --git a/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml b/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml
index c8d3f73f..3f51b6f2 100644
--- a/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml
+++ b/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml
@@ -24,7 +24,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       # NOTE (@Techassi): Does it maybe make sense to have two different service accounts?
-      serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount
+      serviceAccountName: {{ include "operator.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.csiNodeDriver.podSecurityContext | nindent 8 }}
       containers:
diff --git a/deploy/helm/secret-operator/templates/serviceaccount.yaml b/deploy/helm/secret-operator/templates/serviceaccount.yaml
index 8ba0d58c..10633e5f 100644
--- a/deploy/helm/secret-operator/templates/serviceaccount.yaml
+++ b/deploy/helm/secret-operator/templates/serviceaccount.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "operator.fullname" . }}-serviceaccount
+  name: {{ include "operator.serviceAccountName" . }}
   labels:
     {{- include "operator.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
@@ -20,7 +20,7 @@ metadata:
     {{- include "operator.labels" . | nindent 4 }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "operator.fullname" . }}-serviceaccount
+    name: {{ include "operator.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole