diff --git a/charts/hub/examples/hub-api-server-tls-secret.yaml b/charts/hub/examples/hub-api-server-tls-secret.yaml
new file mode 100644
index 0000000..ac39323
--- /dev/null
+++ b/charts/hub/examples/hub-api-server-tls-secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hub-api-server-tls
+  namespace: kerberos-hub
+type: kubernetes.io/tls
+stringData:
+  # Paste your PEM certificate chain here (e.g., fullchain.pem)
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_YOUR_CERTIFICATE
+    -----END CERTIFICATE-----
+  # Paste your PEM private key here (e.g., privkey.pem)
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    REPLACE_WITH_YOUR_PRIVATE_KEY
+    -----END PRIVATE KEY-----
diff --git a/charts/hub/templates/kerberos-hub/hub-api.yaml b/charts/hub/templates/kerberos-hub/hub-api.yaml
index d111cc9..0d9d87e 100644
--- a/charts/hub/templates/kerberos-hub/hub-api.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-api.yaml
@@ -127,10 +127,18 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.api.volumes }}
+      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
+      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
       volumes:
+      {{- with .Values.kerberoshub.api.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $serverTLS.enabled $serverTLS.secretName }}
+        - name: hub-api-server-tls
+          secret:
+            secretName: {{ $serverTLS.secretName }}
+      {{- end }}
+      {{- end }}
       containers:
         - name: hub-api
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
@@ -142,10 +150,17 @@ spec:
           ports:
             - containerPort: 80
               name: http
-          {{- with .Values.kerberoshub.api.volumeMounts}}
+          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.api.volumeMounts}}
             {{- toYaml . | nindent 12 }}
-          {{- end }}          
+          {{- end }}
+          {{- if and $serverTLS.enabled $serverTLS.secretName }}
+            - name: hub-api-server-tls
+              mountPath: {{ $serverTLS.mountPath }}
+              readOnly: true
+          {{- end }}
+          {{- end }}
           # Mongodb - loaded from ConfigMap
           envFrom:
             - configMapRef:
@@ -178,6 +193,12 @@ spec:
               value: "{{ .Values.kerberoshub.api.fallbackLanguage }}"
             - name: API_KEY
               value: "{{ .Values.kerberoshub.api.apiKey }}"
+            {{- if .Values.kerberoshub.api.serverTLS.enabled }}
+            - name: TLS_CERT_FILE
+              value: "{{ .Values.kerberoshub.api.serverTLS.certFile }}"
+            - name: TLS_KEY_FILE
+              value: "{{ .Values.kerberoshub.api.serverTLS.keyFile }}"
+            {{- end }}
 
             # Kerberos Hub
             - name: LICENSE_KEY
diff --git a/charts/hub/values.yaml b/charts/hub/values.yaml
index 592c8c4..3a258bd 100644
--- a/charts/hub/values.yaml
+++ b/charts/hub/values.yaml
@@ -209,6 +209,16 @@ kerberoshub:
     #    persistentVolumeClaim:
     #      claimName: custom-layout-claim
 
+    # Server-side TLS for hub-api itself (port 8081).
+    # When enabled, TLS_CERT_FILE and TLS_KEY_FILE are injected and
+    # the provided Kubernetes TLS secret is mounted read-only.
+    serverTLS:
+      enabled: false
+      secretName: ""
+      mountPath: "/etc/hub-api/tls"
+      certFile: "/etc/hub-api/tls/tls.crt"
+      keyFile: "/etc/hub-api/tls/tls.key"
+
     # When migrating to another url, this might help migrating.
     #legacyUrl: "api.legacy.yourdomain.com"