diff --git a/bin/sa-can-read-s3.sh b/bin/sa-can-read-s3.sh
index a6d001de..c6b02b66 100755
--- a/bin/sa-can-read-s3.sh
+++ b/bin/sa-can-read-s3.sh
@@ -75,7 +75,7 @@ create_role() {
 }
 
 annotate_serviceaccount() {
-    kubectl annotate serviceaccounts default -n default "role-arn=arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}"
+    kubectl annotate serviceaccounts default -n default "role-arn=arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}" --overwrite
 }
 
 checkit() {