diff --git a/helm/kagent-tools/templates/deployment.yaml b/helm/kagent-tools/templates/deployment.yaml
index c92c9c6..65a3464 100644
--- a/helm/kagent-tools/templates/deployment.yaml
+++ b/helm/kagent-tools/templates/deployment.yaml
@@ -114,6 +114,12 @@ spec:
           volumeMounts:
             - name: tmp
               mountPath: /tmp
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
       volumes:
         - name: tmp
           emptyDir: {}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
diff --git a/helm/kagent-tools/values.yaml b/helm/kagent-tools/values.yaml
index b398a00..875f579 100644
--- a/helm/kagent-tools/values.yaml
+++ b/helm/kagent-tools/values.yaml
@@ -131,3 +131,15 @@ otel:
         endpoint: http://host.docker.internal:4317
         timeout: 15
         insecure: true
+
+# Additional volumes and volumeMounts on the tools container. Useful for mounting a
+# kubeconfig (e.g. to point kubectl at an authenticating proxy for per-user RBAC),
+# extra CAs, etc. Standard Kubernetes volume / volumeMount objects.
+extraVolumes: []
+# - name: my-kubeconfig
+#   configMap:
+#     name: my-kubeconfig
+extraVolumeMounts: []
+# - name: my-kubeconfig
+#   mountPath: /etc/kubeconfig
+#   readOnly: true