diff --git a/charts/capsule/Chart.yaml b/charts/capsule/Chart.yaml
index de2a932c..e57f6fbb 100644
--- a/charts/capsule/Chart.yaml
+++ b/charts/capsule/Chart.yaml
@@ -21,7 +21,7 @@ sources:
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.4.1
+version: 0.4.2
 
 # This is the version number of the application being deployed.
 # This version number should be incremented each time you make changes to the application.
diff --git a/charts/capsule/README.md b/charts/capsule/README.md
index c749e357..d7e0040d 100644
--- a/charts/capsule/README.md
+++ b/charts/capsule/README.md
@@ -101,6 +101,7 @@ Here the values you can override:
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
 | manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
+| manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
 | manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
 | manager.resources.limits.cpu | string | `"200m"` |  |
diff --git a/charts/capsule/templates/configuration-default.yaml b/charts/capsule/templates/configuration-default.yaml
index 1356fd58..bd5b6513 100644
--- a/charts/capsule/templates/configuration-default.yaml
+++ b/charts/capsule/templates/configuration-default.yaml
@@ -20,3 +20,7 @@ spec:
     - {{ . }}
 {{- end}}
   protectedNamespaceRegex: {{ .Values.manager.options.protectedNamespaceRegex | quote }}
+  {{- with .Values.manager.options.nodeMetadata }}
+  nodeMetadata:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml
index f086dc1a..215a3426 100644
--- a/charts/capsule/values.yaml
+++ b/charts/capsule/values.yaml
@@ -51,6 +51,14 @@ manager:
     protectedNamespaceRegex: ""
     # -- Specifies whether capsule webhooks certificates should be generated by capsule operator
     generateCertificates: true
+    # -- Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant
+    nodeMetadata:
+      forbiddenLabels:
+        denied: []
+        deniedRegex: ""
+      forbiddenAnnotations:
+        denied: []
+        deniedRegex: ""
 
   # -- Configure the liveness probe using Deployment probe spec
   livenessProbe: