diff --git a/module/config/rbac/role.yaml b/module/config/rbac/role.yaml
index 3f82108..04dac5f 100644
--- a/module/config/rbac/role.yaml
+++ b/module/config/rbac/role.yaml
@@ -21,6 +21,7 @@ rules:
   verbs:
   - get
   - list
+  - watch
 - apiGroups:
   - fleet.squaremo.dev
   resources:
diff --git a/module/controllers/bootstrap_test.go b/module/controllers/bootstrap_test.go
index 1816d25..3bfe70d 100644
--- a/module/controllers/bootstrap_test.go
+++ b/module/controllers/bootstrap_test.go
@@ -178,6 +178,8 @@ var _ = Describe("bootstrap module controller", func() {
 			cluster.Namespace = namespace.Name
 			clusters[cluster.Name] = cluster
 			Expect(k8sClient.Create(context.TODO(), cluster)).To(Succeed())
+			cluster.Status.ControlPlaneReady = true
+			Expect(k8sClient.Status().Update(context.Background(), cluster)).To(Succeed())
 		}
 
 	})
diff --git a/module/controllers/bootstrapmodule_controller.go b/module/controllers/bootstrapmodule_controller.go
index a9f5b5e..316c752 100644
--- a/module/controllers/bootstrapmodule_controller.go
+++ b/module/controllers/bootstrapmodule_controller.go
@@ -109,6 +109,13 @@ func (r *BootstrapModuleReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 clusters:
 	for _, cluster := range clusters.Items {
+		// Don't bother if the cluster isn't marked as ready yet. Creating an assemblage targeting
+		// an unready cluster means lots of failures and back-off.
+		if !cluster.Status.ControlPlaneReady {
+			// TODO: should this be a separate field in the summary, e.g., "waiting"?
+			log.Info("waiting for cluster to be ready", "name", cluster.GetName())
+			continue
+		}
 		summary.Total++
 		requiredAsm[cluster.GetName()] = struct{}{}
 
diff --git a/module/controllers/module_controller.go b/module/controllers/module_controller.go
index a6e4b83..41cc0c7 100644
--- a/module/controllers/module_controller.go
+++ b/module/controllers/module_controller.go
@@ -82,6 +82,13 @@ func (r *ModuleReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 
 clusters:
 	for _, cluster := range clusters.Items {
+		// Don't bother if the cluster isn't marked as ready yet. Creating an assemblage targeting
+		// an unready cluster means lots of failures and back-off.
+		if !cluster.Status.ControlPlaneReady {
+			// TODO: should this be a separate field in the summary, e.g., "waiting"?
+			log.Info("waiting for cluster to be ready", "name", cluster.GetName())
+			continue
+		}
 		summary.Total++
 		// This loop makes sure every cluster that matches the
 		// selector has a remote assemblage with the latest definition
diff --git a/module/controllers/module_test.go b/module/controllers/module_test.go
index fc74435..61c49ae 100644
--- a/module/controllers/module_test.go
+++ b/module/controllers/module_test.go
@@ -119,6 +119,8 @@ var _ = Describe("modules", func() {
 					"environment": "production",
 				})
 				Expect(k8sClient.Create(context.Background(), cluster)).To(Succeed())
+				cluster.Status.ControlPlaneReady = true
+				Expect(k8sClient.Status().Update(context.Background(), cluster)).To(Succeed())
 			}
 		})
 
@@ -177,6 +179,8 @@ var _ = Describe("modules", func() {
 				newCluster.Name = "newcluster"
 				newCluster.Namespace = namespace.Name
 				Expect(k8sClient.Create(context.TODO(), &newCluster)).To(Succeed())
+				newCluster.Status.ControlPlaneReady = true
+				Expect(k8sClient.Status().Update(context.Background(), &newCluster)).To(Succeed())
 
 				var newAsm fleetv1.ProxyAssemblage
 				Eventually(func() bool {
@@ -326,6 +330,8 @@ var _ = Describe("modules", func() {
 			cluster.Namespace = namespace.Name
 			cluster.Name = "clus-" + randString(5)
 			Expect(k8sClient.Create(context.TODO(), &cluster)).To(Succeed())
+			cluster.Status.ControlPlaneReady = true
+			Expect(k8sClient.Status().Update(context.Background(), &cluster)).To(Succeed())
 
 			module := fleetv1.Module{
 				Spec: fleetv1.ModuleSpec{