diff --git a/minio/justfile b/minio/justfile
index 2245baa..eb53323 100644
--- a/minio/justfile
+++ b/minio/justfile
@@ -248,15 +248,17 @@ get-user-credentials user='':
     fi
 
 # Grant policy to user for specific operations
-grant-policy user='' policy='readwrite':
+grant-policy user='' policy='':
     #!/bin/bash
     set -euo pipefail
     USER="{{ user }}"
     POLICY="{{ policy }}"
-
     while [ -z "${USER}" ]; do
         USER=$(gum input --prompt="Username: " --width=100 --placeholder="e.g., dagster")
     done
+    if [ -z "${POLICY}" ]; then
+        POLICY=$(gum choose --header="Select policy to grant:" "readwrite" "readonly" "writeonly")
+    fi
 
     echo "Granting ${POLICY} policy to user ${USER}..."
 
@@ -264,7 +266,8 @@ grant-policy user='' policy='readwrite':
     ROOT_PASSWORD=$(just root-password)
 
     # Get the MinIO pod name dynamically
-    MINIO_POD=$(kubectl get pods -n ${MINIO_NAMESPACE} -l app.kubernetes.io/name=minio -o jsonpath='{.items[0].metadata.name}')
+    MINIO_POD=$(kubectl get pods -n ${MINIO_NAMESPACE} -l app=minio \
+        -o jsonpath='{.items[0].metadata.name}')
 
     kubectl -n ${MINIO_NAMESPACE} exec ${MINIO_POD} -- \
         bash -c "mc alias set local http://localhost:9000 ${ROOT_USER} ${ROOT_PASSWORD} && \