diff --git a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
index 357546a8c0..3cb0d018d6 100644
--- a/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
+++ b/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml
@@ -1023,6 +1023,14 @@ items:
     - get
     - patch
     - update
+  - apiGroups:
+    - node.k8s.io
+    resources:
+    - runtimeclasses
+    verbs:
+    - get
+    - list
+    - watch
 - apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
diff --git a/test/e2e/node/runtimeclass.go b/test/e2e/node/runtimeclass.go
index 9557fc07db..d062854feb 100644
--- a/test/e2e/node/runtimeclass.go
+++ b/test/e2e/node/runtimeclass.go
@@ -43,12 +43,6 @@ var _ = SIGDescribe("RuntimeClass", func() {
 		expectSandboxFailureEvent(f, pod, fmt.Sprintf("\"%s\" not found", rcName))
 	})
 
-	It("should run a Pod requesting a RuntimeClass with an empty handler", func() {
-		rcName := createRuntimeClass(f, "empty-handler", "")
-		pod := createRuntimeClassPod(f, rcName)
-		expectPodSuccess(f, pod)
-	})
-
 	It("should reject a Pod requesting a RuntimeClass with an unconfigured handler", func() {
 		handler := f.Namespace.Name + "-handler"
 		rcName := createRuntimeClass(f, "unconfigured-handler", handler)
@@ -57,7 +51,7 @@ var _ = SIGDescribe("RuntimeClass", func() {
 	})
 
 	It("should reject a Pod requesting a deleted RuntimeClass", func() {
-		rcName := createRuntimeClass(f, "delete-me", "")
+		rcName := createRuntimeClass(f, "delete-me", "runc")
 		rcClient := f.ClientSet.NodeV1beta1().RuntimeClasses()
 
 		By("Deleting RuntimeClass "+rcName, func() {