diff --git a/pkg/hub/managedcluster/bindata/bindata.go b/pkg/hub/managedcluster/bindata/bindata.go
index fb699ff53..c58b83d36 100644
--- a/pkg/hub/managedcluster/bindata/bindata.go
+++ b/pkg/hub/managedcluster/bindata/bindata.go
@@ -214,6 +214,8 @@ kind: Role
 metadata:
   name: {{ .ManagedClusterName }}:managed-cluster-work
   namespace: {{ .ManagedClusterName }}
+  finalizers:
+  - cluster.open-cluster-management.io/manifest-work-cleanup
 rules:
 # Allow work agent to send event to hub
 - apiGroups: ["", "events.k8s.io"]
@@ -249,6 +251,8 @@ kind: RoleBinding
 metadata:
   name: {{ .ManagedClusterName }}:managed-cluster-work
   namespace: {{ .ManagedClusterName }}
+  finalizers:
+  - cluster.open-cluster-management.io/manifest-work-cleanup
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/pkg/hub/managedcluster/manifests/managedcluster-work-role.yaml b/pkg/hub/managedcluster/manifests/managedcluster-work-role.yaml
index 41ab28a2a..be9722310 100644
--- a/pkg/hub/managedcluster/manifests/managedcluster-work-role.yaml
+++ b/pkg/hub/managedcluster/manifests/managedcluster-work-role.yaml
@@ -3,6 +3,8 @@ kind: Role
 metadata:
   name: {{ .ManagedClusterName }}:managed-cluster-work
   namespace: {{ .ManagedClusterName }}
+  finalizers:
+  - cluster.open-cluster-management.io/manifest-work-cleanup
 rules:
 # Allow work agent to send event to hub
 - apiGroups: ["", "events.k8s.io"]
diff --git a/pkg/hub/managedcluster/manifests/managedcluster-work-rolebinding.yaml b/pkg/hub/managedcluster/manifests/managedcluster-work-rolebinding.yaml
index d913b0d5e..c3737d62c 100644
--- a/pkg/hub/managedcluster/manifests/managedcluster-work-rolebinding.yaml
+++ b/pkg/hub/managedcluster/manifests/managedcluster-work-rolebinding.yaml
@@ -3,6 +3,8 @@ kind: RoleBinding
 metadata:
   name: {{ .ManagedClusterName }}:managed-cluster-work
   namespace: {{ .ManagedClusterName }}
+  finalizers:
+  - cluster.open-cluster-management.io/manifest-work-cleanup
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role