diff --git a/helm-chart/templates/12-config-map.yaml b/helm-chart/templates/12-config-map.yaml
index dc7f15641..f6f5103da 100644
--- a/helm-chart/templates/12-config-map.yaml
+++ b/helm-chart/templates/12-config-map.yaml
@@ -30,6 +30,7 @@ data:
                 {{- end }}'
     AUTH_SAML_IDP_METADATA_URL: '{{ .Values.tap.auth.saml.idpMetadataUrl }}'
     AUTH_ROLES: '{{ .Values.tap.auth.roles | toJson }}'
+    AUTH_CLI_SERVICE_ACCOUNTS: '{{ if (((.Values.tap).auth).cli).enabled }}{{ .Release.Namespace }}:kubeshark-cli{{ end }}'
     AUTH_ROLES_CLAIM: '{{ .Values.tap.auth.rolesClaim }}'
     AUTH_DEFAULT_ROLE: '{{ default "" .Values.tap.auth.defaultRole }}'
     AUTH_OIDC_ISSUER: '{{ default "not set" (((.Values.tap).auth).oidc).issuer }}'
diff --git a/helm-chart/templates/22-cli-auth.yaml b/helm-chart/templates/22-cli-auth.yaml
new file mode 100644
index 000000000..667e739d4
--- /dev/null
+++ b/helm-chart/templates/22-cli-auth.yaml
@@ -0,0 +1,44 @@
+{{- if (((.Values.tap).auth).cli).enabled }}
+---
+# ServiceAccount the CLI mints a short-lived token for (TokenRequest API) to
+# authenticate to a gated Hub. Its name must match the Hub's
+# AUTH_CLI_SERVICE_ACCOUNTS allowlist and the CLI's kubeshark-cli constant.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "kubeshark.labels" . | nindent 4 }}
+  name: kubeshark-cli
+  namespace: {{ .Release.Namespace }}
+---
+# Permission to mint a token for the kubeshark-cli SA. Binding this Role to a
+# subject is what grants that subject CLI access to a gated Hub.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    {{- include "kubeshark.labels" . | nindent 4 }}
+  name: kubeshark-cli-token-minter
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    resourceNames: ["kubeshark-cli"]
+    verbs: ["create"]
+{{- with .Values.tap.auth.cli.subjects }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "kubeshark.labels" $ | nindent 4 }}
+  name: kubeshark-cli-token-minter
+  namespace: {{ $.Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeshark-cli-token-minter
+subjects:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
diff --git a/helm-chart/values.yaml b/helm-chart/values.yaml
index 93ea01244..32245d2a6 100644
--- a/helm-chart/values.yaml
+++ b/helm-chart/values.yaml
@@ -169,6 +169,21 @@ tap:
     rolesClaim: role
     defaultRole: ""
     defaultFilter: ""
+    # CLI ServiceAccount-token auth (gated-auth phase 2a). When enabled, the
+    # chart creates a `kubeshark-cli` ServiceAccount and a Role permitting
+    # `create` on its token, and the Hub allowlists it via
+    # AUTH_CLI_SERVICE_ACCOUNTS. The CLI mints a short-lived token for that SA
+    # to authenticate to a gated Hub. Map `kubeshark-cli` to a role via
+    # `groupMapping` (or `defaultRole`); without a mapping it falls back to
+    # `defaultRole`.
+    cli:
+      enabled: false
+      # RBAC subjects allowed to mint the kubeshark-cli token — i.e. who may
+      # use the CLI against a gated Hub. Example:
+      #   - kind: User
+      #     name: alice@example.com
+      #     apiGroup: rbac.authorization.k8s.io
+      subjects: []
     saml:
       idpMetadataUrl: ""
       x509crt: ""