diff --git a/base/utils/config.go b/base/utils/config.go
index 9077291ad..d3dad80aa 100644
--- a/base/utils/config.go
+++ b/base/utils/config.go
@@ -274,6 +274,15 @@ func initKafkaFromClowder() {
 type Endpoint clowder.DependencyEndpoint
 type PrivateEndpoint clowder.PrivateDependencyEndpoint
 
+// resolveRbacV2Address returns the RBAC address from V2 dependency endpoints,
+// or empty string if V2 is not available.
+func resolveRbacV2Address() string {
+	if endpoint, ok := clowder.GetV2DependencyEndpoint("rbac", "service"); ok && endpoint.Uri != "" {
+		return endpoint.Uri
+	}
+	return ""
+}
+
 func initServicesFromClowder() {
 	webappName := "webapp-service"
 	if PodConfig.GetBool("use_vmaas_go", true) {
@@ -286,7 +295,12 @@ func initServicesFromClowder() {
 				CoreCfg.VmaasAddress = (*Endpoint)(&endpoint).buildURL()
 			}
 		case "rbac":
-			CoreCfg.RbacAddress = (*Endpoint)(&endpoint).buildURL()
+			// Prefer V2 dependency endpoint; fall back to V1 flat list.
+			if addr := resolveRbacV2Address(); addr != "" {
+				CoreCfg.RbacAddress = addr
+			} else {
+				CoreCfg.RbacAddress = (*Endpoint)(&endpoint).buildURL()
+			}
 		case "rbac-service":
 			CoreCfg.RbacURL = (*Endpoint)(&endpoint).buildURL()
 		case "content-sources-backend":
diff --git a/base/utils/config_clowder_v2_test.go b/base/utils/config_clowder_v2_test.go
new file mode 100644
index 000000000..0e1a25e71
--- /dev/null
+++ b/base/utils/config_clowder_v2_test.go
@@ -0,0 +1,98 @@
+package utils
+
+import (
+	"os"
+	"testing"
+
+	clowder "github.com/redhatinsights/app-common-go/pkg/api/v1"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestResolveRbacV2Address(t *testing.T) {
+	origV2 := clowder.DependencyEndpointsV2
+	defer func() { clowder.DependencyEndpointsV2 = origV2 }()
+
+	t.Run("V2 available with URI", func(t *testing.T) {
+		clowder.DependencyEndpointsV2 = map[string]map[string]clowder.DependencyEndpointV2{
+			"rbac": {
+				"service": {Uri: "https://rbac-service.svc:8443", Authenticated: false},
+			},
+		}
+		assert.Equal(t, "https://rbac-service.svc:8443", resolveRbacV2Address())
+	})
+
+	t.Run("V2 nil map", func(t *testing.T) {
+		clowder.DependencyEndpointsV2 = nil
+		assert.Equal(t, "", resolveRbacV2Address())
+	})
+
+	t.Run("V2 empty URI", func(t *testing.T) {
+		clowder.DependencyEndpointsV2 = map[string]map[string]clowder.DependencyEndpointV2{
+			"rbac": {
+				"service": {Uri: "", Authenticated: false},
+			},
+		}
+		assert.Equal(t, "", resolveRbacV2Address())
+	})
+
+	t.Run("V2 wrong app key", func(t *testing.T) {
+		clowder.DependencyEndpointsV2 = map[string]map[string]clowder.DependencyEndpointV2{
+			"other-app": {
+				"service": {Uri: "https://other.svc:8443", Authenticated: false},
+			},
+		}
+		assert.Equal(t, "", resolveRbacV2Address())
+	})
+
+	t.Run("V2 wrong deployment key", func(t *testing.T) {
+		clowder.DependencyEndpointsV2 = map[string]map[string]clowder.DependencyEndpointV2{
+			"rbac": {
+				"wrong-deploy": {Uri: "https://rbac.svc:8443", Authenticated: false},
+			},
+		}
+		assert.Equal(t, "", resolveRbacV2Address())
+	})
+
+	t.Run("V2 with CA certificate", func(t *testing.T) {
+		caPath := "/tmp/ca.crt"
+		clowder.DependencyEndpointsV2 = map[string]map[string]clowder.DependencyEndpointV2{
+			"rbac": {
+				"service": {
+					Uri:           "https://rbac-service.svc:8443",
+					Authenticated: false,
+					CaCertificate: &caPath,
+				},
+			},
+		}
+		assert.Equal(t, "https://rbac-service.svc:8443", resolveRbacV2Address())
+	})
+}
+
+func TestRbacAddressEnvOverride(t *testing.T) {
+	origAddr := CoreCfg.RbacAddress
+	defer func() { CoreCfg.RbacAddress = origAddr }()
+
+	// Simulate V2-resolved address
+	CoreCfg.RbacAddress = "https://rbac-service.svc:8443"
+
+	// Env var override takes precedence (initServicesFromEnv behavior)
+	t.Setenv("RBAC_ADDRESS", "http://localhost:8080")
+	initServicesFromEnv()
+	assert.Equal(t, "http://localhost:8080", CoreCfg.RbacAddress)
+}
+
+func TestRbacAddressEnvPreservesV2WhenUnset(t *testing.T) {
+	origAddr := CoreCfg.RbacAddress
+	defer func() { CoreCfg.RbacAddress = origAddr }()
+
+	// Simulate V2-resolved address
+	CoreCfg.RbacAddress = "https://rbac-service.svc:8443"
+
+	// No env override: Getenv returns current value as default.
+	// t.Setenv registers cleanup to restore original value after test;
+	// os.Unsetenv then clears it so LookupEnv returns ok=false.
+	t.Setenv("RBAC_ADDRESS", "")
+	os.Unsetenv("RBAC_ADDRESS")
+	initServicesFromEnv()
+	assert.Equal(t, "https://rbac-service.svc:8443", CoreCfg.RbacAddress)
+}