diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml
index fea5a1006..c8bfc3539 100644
--- a/helm-charts/secrets-operator/Chart.yaml
+++ b/helm-charts/secrets-operator/Chart.yaml
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v0.9.0
+version: v0.9.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.9.0"
+appVersion: "v0.9.1"
diff --git a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml
index 9030680e7..505a9ef04 100644
--- a/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml
+++ b/helm-charts/secrets-operator/templates/infisicaldynamicsecret-crd.yaml
@@ -74,6 +74,13 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set to
+                          `true`, the operator will automatically create a service account
+                          token for the configured service account. This field is recommended
+                          in most cases.
+                        type: boolean
                       identityId:
                         type: string
                       serviceAccountRef:
@@ -86,6 +93,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account token.
+                          This is only relevant if `autoCreateServiceAccountToken` is
+                          true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - serviceAccountRef
diff --git a/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml
index 0c73101a3..5afb4f519 100644
--- a/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml
+++ b/helm-charts/secrets-operator/templates/infisicalpushsecret-crd.yaml
@@ -74,6 +74,13 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set to
+                          `true`, the operator will automatically create a service account
+                          token for the configured service account. This field is recommended
+                          in most cases.
+                        type: boolean
                       identityId:
                         type: string
                       serviceAccountRef:
@@ -86,6 +93,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account token.
+                          This is only relevant if `autoCreateServiceAccountToken` is
+                          true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - serviceAccountRef
diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml
index da6edab68..a8a729ded 100644
--- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml
+++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml
@@ -137,6 +137,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set to
+                          `true`, the operator will automatically create a service account
+                          token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       secretsScope:
@@ -164,6 +170,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account token.
+                          This is only relevant if `autoCreateServiceAccountToken` is
+                          true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - secretsScope
diff --git a/helm-charts/secrets-operator/templates/manager-rbac.yaml b/helm-charts/secrets-operator/templates/manager-rbac.yaml
index f47ebd64c..3ab1a7409 100644
--- a/helm-charts/secrets-operator/templates/manager-rbac.yaml
+++ b/helm-charts/secrets-operator/templates/manager-rbac.yaml
@@ -23,6 +23,13 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
 - apiGroups:
   - ""
   resources:
@@ -42,6 +49,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 - apiGroups:
   - apps
   resources:
@@ -62,6 +75,12 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
 - apiGroups:
   - secrets.infisical.com
   resources:
diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml
index 80ed74356..cb96f3959 100644
--- a/helm-charts/secrets-operator/values.yaml
+++ b/helm-charts/secrets-operator/values.yaml
@@ -32,7 +32,7 @@ controllerManager:
         - ALL
     image:
       repository: infisical/kubernetes-operator
-      tag: v0.9.0
+      tag: v0.9.1
     resources:
       limits:
         cpu: 500m
diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml
index bcaf2b540..341155efb 100644
--- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml
+++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml
@@ -77,7 +77,8 @@ spec:
                         description: Optionally automatically create a service account
                           token for the configured service account. If this is set
                           to `true`, the operator will automatically create a service
-                          account token for the configured service account.
+                          account token for the configured service account. This field
+                          is recommended in most cases.
                         type: boolean
                       identityId:
                         type: string
diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml
index 31779c2f2..37df72854 100644
--- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml
+++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml
@@ -77,7 +77,8 @@ spec:
                         description: Optionally automatically create a service account
                           token for the configured service account. If this is set
                           to `true`, the operator will automatically create a service
-                          account token for the configured service account.
+                          account token for the configured service account. This field
+                          is recommended in most cases.
                         type: boolean
                       identityId:
                         type: string