diff --git a/chart/README.md b/chart/README.md
index 40a83bd..d8f61dd 100644
--- a/chart/README.md
+++ b/chart/README.md
@@ -408,7 +408,7 @@ exporter-toolkit is the recommended path on new installs.
 | prometheusServiceMonitor.metricRelabelings | list | `[]` | Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusServiceMonitor.relabelings | list | `[]` | Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusServiceMonitor.scheme | string | `"http"` | Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
-| prometheusServiceMonitor.basicAuth | object | `{}` | BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
+| prometheusServiceMonitor.basicAuth | object | `{}` | BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
 | prometheusServiceMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
 | prometheusPodMonitor.create | bool | `false` | Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users. |
 | prometheusPodMonitor.scrapeInterval | string | `"60s"` | Target scrape interval set in the PodMonitor |
@@ -417,7 +417,7 @@ exporter-toolkit is the recommended path on new installs.
 | prometheusPodMonitor.metricRelabelings | list | `[]` | Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusPodMonitor.relabelings | list | `[]` | Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusPodMonitor.scheme | string | `"http"` | Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
-| prometheusPodMonitor.basicAuth | object | `{}` | BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
+| prometheusPodMonitor.basicAuth | object | `{}` | BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
 | prometheusPodMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
 | prometheusRules.create | bool | `true` | Should a PrometheusRule object be installed to alert on certificate expiration. For prometheus-operator (kube-prometheus) users. |
 | prometheusRules.rulePrefix | string | `""` | Prefix prepended to the alert rule names of PrometheusRule rules |
diff --git a/chart/templates/podmonitor.yaml b/chart/templates/podmonitor.yaml
index dbbbf91..e22cc5d 100644
--- a/chart/templates/podmonitor.yaml
+++ b/chart/templates/podmonitor.yaml
@@ -21,6 +21,9 @@ spec:
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     {{- end }}
     scheme: {{ .Values.prometheusPodMonitor.scheme }}
+    {{- if and .Values.rbacProxy.enabled .Values.prometheusPodMonitor.basicAuth }}
+    {{- fail "prometheusPodMonitor.basicAuth cannot be combined with rbacProxy.enabled: kube-rbac-proxy authenticates scrapes with the Prometheus ServiceAccount bearer token, and a monitor endpoint must define a single authentication method" }}
+    {{- end }}
     {{- with .Values.prometheusPodMonitor.basicAuth }}
     basicAuth:
     {{- . | toYaml | nindent 6 }}
diff --git a/chart/templates/servicemonitor.yaml b/chart/templates/servicemonitor.yaml
index 3b448e3..7a50aaf 100644
--- a/chart/templates/servicemonitor.yaml
+++ b/chart/templates/servicemonitor.yaml
@@ -25,6 +25,9 @@ spec:
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     {{- end }}
     scheme: {{ .Values.prometheusServiceMonitor.scheme }}
+    {{- if and .Values.rbacProxy.enabled .Values.prometheusServiceMonitor.basicAuth }}
+    {{- fail "prometheusServiceMonitor.basicAuth cannot be combined with rbacProxy.enabled: kube-rbac-proxy authenticates scrapes with the Prometheus ServiceAccount bearer token, and a monitor endpoint must define a single authentication method" }}
+    {{- end }}
     {{- with .Values.prometheusServiceMonitor.basicAuth }}
     basicAuth:
     {{- . | toYaml | nindent 6 }}
diff --git a/chart/values.yaml b/chart/values.yaml
index d010301..a6b1082 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -826,7 +826,7 @@ prometheusServiceMonitor:
   # type: object
   # additionalProperties: true
   # @schema
-  # -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
+  # -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
   basicAuth: {}
   # @schema
   # type: object
@@ -873,7 +873,7 @@ prometheusPodMonitor:
   # type: object
   # additionalProperties: true
   # @schema
-  # -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
+  # -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
   basicAuth: {}
   # @schema
   # type: object