diff --git a/helm/garage-ui/templates/jwt.yaml b/helm/garage-ui/templates/jwt.yaml
new file mode 100644
index 0000000..5ad38b4
--- /dev/null
+++ b/helm/garage-ui/templates/jwt.yaml
@@ -0,0 +1,105 @@
+{{- if not .Values.config.auth.jwt_private_key_secret.name }}
+{{- $secretName := printf "%s-jwt-key" (include "garage-ui.fullname" .) }}
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
+{{- if not $existingSecret }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+      containers:
+      - name: jwt-key-generator
+        image: alpine:3.18
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+
+          # Install openssl
+          apk add --no-cache openssl kubectl
+
+          # Generate Ed25519 private key
+          openssl genpkey -algorithm ED25519 -out /tmp/jwt-key.pem
+
+          # Create Kubernetes secret
+          kubectl create secret generic {{ $secretName }} \
+            --from-file=jwt-key.pem=/tmp/jwt-key.pem \
+            --namespace={{ .Release.Namespace }} \
+            --dry-run=client -o yaml | kubectl apply -f -
+
+          # Add labels to the secret
+          kubectl label secret {{ $secretName }} \
+            --namespace={{ .Release.Namespace }} \
+            helm.sh/chart={{ include "garage-ui.chart" . }} \
+            {{ include "garage-ui.selectorLabels" . | replace ": " "=" | replace "\n" " " }} \
+            app.kubernetes.io/version={{ .Chart.AppVersion | quote }} \
+            app.kubernetes.io/managed-by={{ .Release.Service }} \
+            --overwrite
+
+          # Add annotation to keep the secret
+          kubectl annotate secret {{ $secretName }} \
+            --namespace={{ .Release.Namespace }} \
+            "helm.sh/resource-policy=keep" \
+            --overwrite
+
+          echo "JWT private key generated and stored in secret: {{ $secretName }}"
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "create", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+  labels:
+    {{- include "garage-ui.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+subjects:
+- kind: ServiceAccount
+  name: {{ include "garage-ui.fullname" . }}-jwt-key-generator
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}