diff --git a/stable/concourse/Chart.yaml b/stable/concourse/Chart.yaml
index 087f39f873..a7c19ab370 100644
--- a/stable/concourse/Chart.yaml
+++ b/stable/concourse/Chart.yaml
@@ -1,5 +1,5 @@
 name: concourse
-version: 0.10.3
+version: 0.10.4
 appVersion: 3.6.0
 description: Concourse is a simple and scalable CI system.
 icon: https://avatars1.githubusercontent.com/u/7809479
@@ -18,4 +18,6 @@ maintainers:
   email: viglesias@google.com
 - name: william-tran
   email: will@autonomic.ai
+- name: nexeck
+  email: marcel@beck.im
 engine: gotpl
diff --git a/stable/concourse/templates/worker-role.yaml b/stable/concourse/templates/worker-role.yaml
new file mode 100644
index 0000000000..01ecf9fd93
--- /dev/null
+++ b/stable/concourse/templates/worker-role.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+kind: Role
+metadata:
+  name: {{ template "concourse.worker.fullname" . }}
+  labels:
+    app: {{ template "concourse.worker.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups:
+  - extensions
+  resources:
+  - podsecuritypolicies
+  resourceNames:
+  - privileged
+  verbs:
+  - use
+{{- end -}}
diff --git a/stable/concourse/templates/worker-rolebinding.yaml b/stable/concourse/templates/worker-rolebinding.yaml
new file mode 100644
index 0000000000..b412b68e2d
--- /dev/null
+++ b/stable/concourse/templates/worker-rolebinding.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+kind: RoleBinding
+metadata:
+  name: {{ template "concourse.worker.fullname" . }}
+  labels:
+    app: {{ template "concourse.worker.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "concourse.worker.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "concourse.worker.fullname" . }}
+{{- end -}}
diff --git a/stable/concourse/templates/worker-serviceaccount.yaml b/stable/concourse/templates/worker-serviceaccount.yaml
new file mode 100644
index 0000000000..486c77966d
--- /dev/null
+++ b/stable/concourse/templates/worker-serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.rbac.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "concourse.worker.fullname" . }}
+  labels:
+    app: {{ template "concourse.worker.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- end -}}
diff --git a/stable/concourse/templates/worker-statefulset.yaml b/stable/concourse/templates/worker-statefulset.yaml
index e5add85c25..2a14c81e60 100644
--- a/stable/concourse/templates/worker-statefulset.yaml
+++ b/stable/concourse/templates/worker-statefulset.yaml
@@ -20,6 +20,7 @@ spec:
         {{ $key }}: {{ $value | quote }}
         {{- end }}
     spec:
+      serviceAccountName: {{ if .Values.rbac.create }}{{ template "concourse.worker.fullname" . }}{{ else }}{{ .Values.rbac.serviceAccountName }}{{ end }}
       tolerations:
 {{ toYaml .Values.worker.tolerations | indent 8 }}
       terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}
diff --git a/stable/concourse/values.yaml b/stable/concourse/values.yaml
index 27381bb5c3..5cc58e155f 100644
--- a/stable/concourse/values.yaml
+++ b/stable/concourse/values.yaml
@@ -585,3 +585,15 @@ credentialManager:
     ## the value will be written to /concourse-vault/client.key
     ## make sure to also set authBackend to `cert`
     # clientKey: |-
+
+## For RBAC support:
+rbac:
+  # true here enables creation of rbac resources
+  create: true
+
+  # rbac version
+  apiVersion: v1beta1
+
+  ## Ignored if rbac.create is true
+  ##
+  serviceAccountName: default