diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go
index 3d02e55ee..e8dccdabb 100644
--- a/k8-operator/api/v1alpha1/infisicalsecret_types.go
+++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go
@@ -5,7 +5,14 @@ import (
 )
 
 type Authentication struct {
+	// +kubebuilder:validation:Optional
 	ServiceAccount ServiceAccountDetails `json:"serviceAccount"`
+	// +kubebuilder:validation:Optional
+	ServiceToken ServiceTokenDetails `json:"serviceToken"`
+}
+
+type ServiceTokenDetails struct {
+	ServiceTokenSecretReference KubeSecretReference `json:"serviceTokenSecretReference"`
 }
 
 type ServiceAccountDetails struct {
@@ -27,10 +34,10 @@ type KubeSecretReference struct {
 // InfisicalSecretSpec defines the desired state of InfisicalSecret
 type InfisicalSecretSpec struct {
 	// +kubebuilder:validation:Optional
-	TokenSecretReference KubeSecretReference `json:"tokenSecretReference,omitempty"`
+	TokenSecretReference KubeSecretReference `json:"tokenSecretReference"`
 
 	// +kubebuilder:validation:Optional
-	Authentication Authentication `json:"authentication,omitempty"`
+	Authentication Authentication `json:"authentication"`
 
 	// +kubebuilder:validation:Required
 	ManagedSecretReference KubeSecretReference `json:"managedSecretReference"`
diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go
index c05e757b8..97c0f4fc7 100644
--- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go
+++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go
@@ -30,6 +30,7 @@ import (
 func (in *Authentication) DeepCopyInto(out *Authentication) {
 	*out = *in
 	out.ServiceAccount = in.ServiceAccount
+	out.ServiceToken = in.ServiceToken
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Authentication.
@@ -171,3 +172,19 @@ func (in *ServiceAccountDetails) DeepCopy() *ServiceAccountDetails {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceTokenDetails) DeepCopyInto(out *ServiceTokenDetails) {
+	*out = *in
+	out.ServiceTokenSecretReference = in.ServiceTokenSecretReference
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceTokenDetails.
+func (in *ServiceTokenDetails) DeepCopy() *ServiceTokenDetails {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceTokenDetails)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml
index a62fa651a..3bcdb0020 100644
--- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml
+++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml
@@ -61,8 +61,24 @@ spec:
                     - projectId
                     - serviceAccountSecretReference
                     type: object
-                required:
-                - serviceAccount
+                  serviceToken:
+                    properties:
+                      serviceTokenSecretReference:
+                        properties:
+                          secretName:
+                            description: The name of the Kubernetes Secret
+                            type: string
+                          secretNamespace:
+                            description: The name space where the Kubernetes Secret
+                              is located
+                            type: string
+                        required:
+                        - secretName
+                        - secretNamespace
+                        type: object
+                    required:
+                    - serviceTokenSecretReference
+                    type: object
                 type: object
               hostAPI:
                 description: Infisical host to pull secrets from
diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml
index adecbedbb..110965421 100644
--- a/k8-operator/config/samples/sample.yaml
+++ b/k8-operator/config/samples/sample.yaml
@@ -4,9 +4,6 @@ metadata:
   name: infisicalsecret-sample
 spec:
   hostAPI: http://localhost:7070/api
-  tokenSecretReference:
-    secretName: service-token
-    secretNamespace: default
   authentication:
     serviceAccount:
       serviceAccountSecretReference:
@@ -14,6 +11,14 @@ spec:
         secretNamespace: default
       projectId: "6439ec224cfbf7ea2a95b651"
       environmentName: "dev"
+    serviceToken:
+      serviceTokenSecretReference:
+        secretName: service-token
+        secretNamespace: default
   managedSecretReference:
     secretName: managed-secret
     secretNamespace: default
+  # To be depreciated soon
+  tokenSecretReference:
+    secretName: service-token
+    secretNamespace: default
diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go
index e528b19d5..faf4a4e30 100644
--- a/k8-operator/controllers/infisicalsecret_helper.go
+++ b/k8-operator/controllers/infisicalsecret_helper.go
@@ -69,9 +69,22 @@ func (r *InfisicalSecretReconciler) GetKubeSecretByNamespacedName(ctx context.Co
 }
 
 func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (string, error) {
+	// default to new secret ref structure
+	secretName := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretName
+	secretNamespace := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretNamespace
+
+	// fall back to previous secret ref
+	if secretName == "" {
+		secretName = infisicalSecret.Spec.TokenSecretReference.SecretName
+	}
+
+	if secretNamespace == "" {
+		secretNamespace = infisicalSecret.Spec.TokenSecretReference.SecretNamespace
+	}
+
 	tokenSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{
-		Namespace: infisicalSecret.Spec.TokenSecretReference.SecretNamespace,
-		Name:      infisicalSecret.Spec.TokenSecretReference.SecretName,
+		Namespace: secretNamespace,
+		Name:      secretName,
 	})
 
 	if errors.IsNotFound(err) {