diff --git a/bundle/manifests/nexus-operator.clusterserviceversion.yaml b/bundle/manifests/nexus-operator.clusterserviceversion.yaml
index 69c99f8b..8b2f7e7e 100644
--- a/bundle/manifests/nexus-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/nexus-operator.clusterserviceversion.yaml
@@ -111,6 +111,14 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - apps.m88i.io
+          resources:
+          - nexus/finalizers
+          verbs:
+          - get
+          - patch
+          - update
         - apiGroups:
           - apps.m88i.io
           resources:
@@ -206,17 +214,6 @@ spec:
                 control-plane: controller-manager
             spec:
               containers:
-              - args:
-                - --secure-listen-address=0.0.0.0:8443
-                - --upstream=http://127.0.0.1:8080/
-                - --logtostderr=true
-                - --v=10
-                image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
-                name: kube-rbac-proxy
-                ports:
-                - containerPort: 8443
-                  name: https
-                resources: {}
               - args:
                 - --metrics-addr=127.0.0.1:8080
                 - --enable-leader-election
@@ -228,6 +225,17 @@ spec:
                   requests:
                     cpu: 100m
                     memory: 20Mi
+              - args:
+                - --secure-listen-address=0.0.0.0:8443
+                - --upstream=http://127.0.0.1:8080/
+                - --logtostderr=true
+                - --v=10
+                image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
+                name: kube-rbac-proxy
+                ports:
+                - containerPort: 8443
+                  name: https
+                resources: {}
               terminationGracePeriodSeconds: 10
       permissions:
       - rules:
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 92cb9563..1eb3ef49 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -42,6 +42,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - apps.m88i.io
+  resources:
+  - nexus/finalizers
+  verbs:
+  - get
+  - patch
+  - update
 - apiGroups:
   - apps.m88i.io
   resources:
diff --git a/controllers/nexus_controller.go b/controllers/nexus_controller.go
index 311e719c..0929bd21 100644
--- a/controllers/nexus_controller.go
+++ b/controllers/nexus_controller.go
@@ -62,6 +62,7 @@ type NexusReconciler struct {
 
 // +kubebuilder:rbac:groups=apps.m88i.io,resources=nexus,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps.m88i.io,resources=nexus/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=apps.m88i.io,resources=nexus/finalizers,verbs=get;update;patch
 // +kubebuilder:rbac:groups=core,resources=services;persistentvolumeclaims;events;secrets;serviceaccounts,verbs=create;delete;get;list;patch;update;watch
 // +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;create
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get
diff --git a/hack/generate-toc.sh b/hack/generate-toc.sh
index fda8b129..db13476f 100755
--- a/hack/generate-toc.sh
+++ b/hack/generate-toc.sh
@@ -13,6 +13,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+declare readme_changed=$(git status -s | grep  'README.md' || :)
+if [ -z "${readme_changed}" ]; then
+  exit 0
+fi
 
 command -v bin/gh-md-toc > /dev/null || curl https://raw.githubusercontent.com/ekalinin/github-markdown-toc/master/gh-md-toc -o bin/gh-md-toc && chmod +x bin/gh-md-toc
 
diff --git a/hack/install.sh b/hack/install.sh
index c65d1e86..9a68fc9d 100755
--- a/hack/install.sh
+++ b/hack/install.sh
@@ -16,7 +16,7 @@
 
 VERSION=$1
 
-if [ -z ${VERSION} ]; then
+if [ -z "${VERSION}" ]; then
     VERSION=$(curl https://api.github.com/repos/m88i/nexus-operator/releases/latest | python -c "import sys, json; print(json.load(sys.stdin)['tag_name'])")
 fi
 
diff --git a/nexus-operator.yaml b/nexus-operator.yaml
index ac14db3e..f3db4a34 100644
--- a/nexus-operator.yaml
+++ b/nexus-operator.yaml
@@ -420,6 +420,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - apps.m88i.io
+  resources:
+  - nexus/finalizers
+  verbs:
+  - get
+  - patch
+  - update
 - apiGroups:
   - apps.m88i.io
   resources:
@@ -590,16 +598,6 @@ spec:
         control-plane: controller-manager
     spec:
       containers:
-      - args:
-        - --secure-listen-address=0.0.0.0:8443
-        - --upstream=http://127.0.0.1:8080/
-        - --logtostderr=true
-        - --v=10
-        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
-        name: kube-rbac-proxy
-        ports:
-        - containerPort: 8443
-          name: https
       - args:
         - --metrics-addr=127.0.0.1:8080
         - --enable-leader-election
@@ -611,6 +609,16 @@ spec:
           requests:
             cpu: 100m
             memory: 20Mi
+      - args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --v=10
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https
       terminationGracePeriodSeconds: 10
 ---
 apiVersion: monitoring.coreos.com/v1