diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml
index 3c79e2eff1..145ded8c2b 100644
--- a/stable/nginx-ingress/Chart.yaml
+++ b/stable/nginx-ingress/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: nginx-ingress
-version: 1.18.0
+version: 1.19.0
 appVersion: 0.25.1
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.
diff --git a/stable/nginx-ingress/README.md b/stable/nginx-ingress/README.md
index a7081bc1d9..665422006b 100644
--- a/stable/nginx-ingress/README.md
+++ b/stable/nginx-ingress/README.md
@@ -190,8 +190,10 @@ Parameter | Description | Default
 `imagePullSecrets` | name of Secret resource containing private registry credentials | `nil`
 `rbac.create` | if `true`, create & use RBAC resources | `true`
 `podSecurityPolicy.enabled` | if `true`, create & use Pod Security Policy resources | `false`
-`serviceAccount.create` | if `true`, create a service account | `true`
-`serviceAccount.name` | The name of the service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | ``
+`serviceAccount.create` | if `true`, create a service account for the controller | `true`
+`serviceAccount.name` | The name of the controller service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | ``
+`serviceAccount.backend.create` | if `true`, create a backend service account. Only useful if you need a pod security policy to run the backend. | `true`
+`serviceAccount.backend.name` | The name of the backend service account to use. If not set and `create` is `true`, a name is generated using the fullname template. Only useful if you need a pod security policy to run the backend. | ``
 `revisionHistoryLimit` | The number of old history to retain to allow rollback. | `10`
 `tcp` | TCP service key:value pairs. The value is evaluated as a template. | `{}`
 `udp` | UDP service key:value pairs The value is evaluated as a template. | `{}`
diff --git a/stable/nginx-ingress/templates/_helpers.tpl b/stable/nginx-ingress/templates/_helpers.tpl
index b65ac2bb40..d5b9e2cc81 100644
--- a/stable/nginx-ingress/templates/_helpers.tpl
+++ b/stable/nginx-ingress/templates/_helpers.tpl
@@ -55,7 +55,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- end -}}
 
 {{/*
-Create the name of the service account to use
+Create the name of the controller service account to use
 */}}
 {{- define "nginx-ingress.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create -}}
@@ -64,3 +64,14 @@ Create the name of the service account to use
     {{ default "default" .Values.serviceAccount.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the backend service account to use - only used when podsecuritypolicy is also enabled
+*/}}
+{{- define "nginx-ingress.defaultBackend.serviceAccountName" -}}
+{{- if .Values.defaultBackend.serviceAccount.create -}}
+    {{ default (printf "%s-backend" (include "nginx-ingress.fullname" .)) .Values.defaultBackend.serviceAccount.name }}
+{{- else -}}
+    {{ default "default-backend" .Values.defaultBackend.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
diff --git a/stable/nginx-ingress/templates/podsecuritypolicy.yaml b/stable/nginx-ingress/templates/controller-psp.yaml
similarity index 95%
rename from stable/nginx-ingress/templates/podsecuritypolicy.yaml
rename to stable/nginx-ingress/templates/controller-psp.yaml
index 9222daf3d0..36ab983ca6 100644
--- a/stable/nginx-ingress/templates/podsecuritypolicy.yaml
+++ b/stable/nginx-ingress/templates/controller-psp.yaml
@@ -2,7 +2,7 @@
 apiVersion: extensions/v1beta1
 kind: PodSecurityPolicy
 metadata:
-  name: {{ template "nginx-ingress.fullname" . }} 
+  name: {{ template "nginx-ingress.fullname" . }}
   labels:
     app: {{ template "nginx-ingress.name" . }}
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
diff --git a/stable/nginx-ingress/templates/role.yaml b/stable/nginx-ingress/templates/controller-role.yaml
similarity index 100%
rename from stable/nginx-ingress/templates/role.yaml
rename to stable/nginx-ingress/templates/controller-role.yaml
diff --git a/stable/nginx-ingress/templates/rolebinding.yaml b/stable/nginx-ingress/templates/controller-rolebinding.yaml
similarity index 100%
rename from stable/nginx-ingress/templates/rolebinding.yaml
rename to stable/nginx-ingress/templates/controller-rolebinding.yaml
diff --git a/stable/nginx-ingress/templates/serviceaccount.yaml b/stable/nginx-ingress/templates/controller-serviceaccount.yaml
similarity index 100%
rename from stable/nginx-ingress/templates/serviceaccount.yaml
rename to stable/nginx-ingress/templates/controller-serviceaccount.yaml
diff --git a/stable/nginx-ingress/templates/default-backend-deployment.yaml b/stable/nginx-ingress/templates/default-backend-deployment.yaml
index 8c139e2d96..5063570ab4 100644
--- a/stable/nginx-ingress/templates/default-backend-deployment.yaml
+++ b/stable/nginx-ingress/templates/default-backend-deployment.yaml
@@ -87,6 +87,7 @@ spec:
       nodeSelector:
 {{ toYaml .Values.defaultBackend.nodeSelector | indent 8 }}
     {{- end }}
+      serviceAccountName: {{ template "nginx-ingress.defaultBackend.serviceAccountName" . }}
     {{- if .Values.defaultBackend.tolerations }}
       tolerations:
 {{ toYaml .Values.defaultBackend.tolerations | indent 8 }}
diff --git a/stable/nginx-ingress/templates/default-backend-psp.yaml b/stable/nginx-ingress/templates/default-backend-psp.yaml
new file mode 100644
index 0000000000..c3739f2bde
--- /dev/null
+++ b/stable/nginx-ingress/templates/default-backend-psp.yaml
@@ -0,0 +1,35 @@
+{{- if and .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "nginx-ingress.fullname" . }}-backend
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  allowPrivilegeEscalation: false
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  requiredDropCapabilities:
+  - ALL
+  runAsUser:
+    rule: MustRunAsNonRoot
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - emptyDir
+  - projected
+  - secret
+  - downwardAPI
+{{- end -}}
diff --git a/stable/nginx-ingress/templates/default-backend-role.yaml b/stable/nginx-ingress/templates/default-backend-role.yaml
new file mode 100644
index 0000000000..9238449ddf
--- /dev/null
+++ b/stable/nginx-ingress/templates/default-backend-role.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-backend
+rules:
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nginx-ingress.fullname" . }}-backend]
+{{- end -}}
diff --git a/stable/nginx-ingress/templates/default-backend-rolebinding.yaml b/stable/nginx-ingress/templates/default-backend-rolebinding.yaml
new file mode 100644
index 0000000000..6bc32ed189
--- /dev/null
+++ b/stable/nginx-ingress/templates/default-backend-rolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-backend
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "nginx-ingress.fullname" . }}-backend
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "nginx-ingress.defaultBackend.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/stable/nginx-ingress/templates/default-backend-serviceaccount.yaml b/stable/nginx-ingress/templates/default-backend-serviceaccount.yaml
new file mode 100644
index 0000000000..b782fb69fd
--- /dev/null
+++ b/stable/nginx-ingress/templates/default-backend-serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- if and .Values.defaultBackend.enabled  .Values.defaultBackend.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.defaultBackend.serviceAccountName" . }}
+{{- end }}
diff --git a/stable/nginx-ingress/values.yaml b/stable/nginx-ingress/values.yaml
index 58efa82d63..0c7d4ab02e 100644
--- a/stable/nginx-ingress/values.yaml
+++ b/stable/nginx-ingress/values.yaml
@@ -384,6 +384,9 @@ defaultBackend:
 
   extraArgs: {}
 
+  serviceAccount:
+    create: true
+    name:
   ## Additional environment variables to set for defaultBackend pods
   extraEnvs: []