diff --git a/helm/kagent-tools/templates/deployment.yaml b/helm/kagent-tools/templates/deployment.yaml
index 5a81ca9..5044ae7 100644
--- a/helm/kagent-tools/templates/deployment.yaml
+++ b/helm/kagent-tools/templates/deployment.yaml
@@ -120,6 +120,12 @@ spec:
           volumeMounts:
             - name: tmp
               mountPath: /tmp
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
       volumes:
         - name: tmp
-          emptyDir: {}
\ No newline at end of file
+          emptyDir: {}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
diff --git a/helm/kagent-tools/tests/deployment_test.yaml b/helm/kagent-tools/tests/deployment_test.yaml
index 84bdaae..703aea8 100644
--- a/helm/kagent-tools/tests/deployment_test.yaml
+++ b/helm/kagent-tools/tests/deployment_test.yaml
@@ -173,3 +173,42 @@ tests:
           value:
             app.kubernetes.io/name: RELEASE-NAME
             app.kubernetes.io/instance: RELEASE-NAME
+
+  - it: should only mount the tmp volume by default
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.volumes
+          count: 1
+      - lengthEqual:
+          path: spec.template.spec.containers[0].volumeMounts
+          count: 1
+
+  - it: should append extraVolumes and extraVolumeMounts after tmp
+    set:
+      extraVolumes:
+        - name: kubeconfig
+          configMap:
+            name: tools-kubeconfig
+      extraVolumeMounts:
+        - name: kubeconfig
+          mountPath: /etc/kubeconfig
+          readOnly: true
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: tmp
+      - equal:
+          path: spec.template.spec.volumes[1]
+          value:
+            name: kubeconfig
+            configMap:
+              name: tools-kubeconfig
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: tmp
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[1]
+          value:
+            name: kubeconfig
+            mountPath: /etc/kubeconfig
+            readOnly: true
diff --git a/helm/kagent-tools/values.yaml b/helm/kagent-tools/values.yaml
index 45755f3..afc4668 100644
--- a/helm/kagent-tools/values.yaml
+++ b/helm/kagent-tools/values.yaml
@@ -148,3 +148,15 @@ otel:
         endpoint: http://host.docker.internal:4317
         timeout: 15
         insecure: true
+
+# Additional volumes and volumeMounts on the tools container. Useful for mounting a
+# kubeconfig (e.g. to point kubectl at an authenticating proxy for per-user RBAC),
+# extra CAs, etc. Standard Kubernetes volume / volumeMount objects.
+extraVolumes: []
+# - name: my-kubeconfig
+#   configMap:
+#     name: my-kubeconfig
+extraVolumeMounts: []
+# - name: my-kubeconfig
+#   mountPath: /etc/kubeconfig
+#   readOnly: true