diff --git a/charts/metal-control-plane/Chart.yaml b/charts/metal-control-plane/Chart.yaml
index 691d3f0..e02761b 100644
--- a/charts/metal-control-plane/Chart.yaml
+++ b/charts/metal-control-plane/Chart.yaml
@@ -3,4 +3,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: A Helm chart for deploying the metal control plane in K8s
 name: metal-control-plane
-version: 0.8.9
+version: 0.9.0
diff --git a/charts/metal-control-plane/templates/metal-console-token-refresher.yaml b/charts/metal-control-plane/templates/metal-console-token-refresher.yaml
new file mode 100644
index 0000000..2db3d31
--- /dev/null
+++ b/charts/metal-control-plane/templates/metal-console-token-refresher.yaml
@@ -0,0 +1,69 @@
+{{- if .Values.metal_console.enabled }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metal-console-token-refresher
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: metal-console-token-refresher
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "update", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["{{ .Values.metal_console.token_file_secret_ref}}"]
+  verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metal-console-token-refresher
+  namespace: "{{ .Release.Namespace }}"
+subjects:
+- kind: ServiceAccount
+  name: metal-console-token-refresher
+  namespace: "{{ .Release.Namespace }}"
+roleRef:
+  kind: Role
+  name: metal-console-token-refresher
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: metal-console-token-refresher
+spec:
+  schedule: "{{ .Values.metal_console.token_refresher.schedule }}"
+  jobTemplate:
+    metadata:
+      name: metal-console-token-refresher
+    spec:
+      template:
+        spec:
+          serviceAccountName: metal-console-token-refresher
+{{- if .Values.metal_registry_auth_enabled }}
+          imagePullSecrets:
+          - name: metal-console-metal-console-registry-credentials
+{{- end }}
+          restartPolicy: OnFailure
+          containers:
+          - name: token-refresher
+            image: "{{ .Values.images.metal_console_token_refresher.image }}:{{ .Values.images.metal_console_token_refresher.tag }}"
+            env:
+            - name: METAL_APISERVER_URL
+              value: http://metal-apiserver:{{ .Values.ports.metal_apiserver }}{{ .Values.metal_apiserver.base_path }}
+            - name: TOKEN_SECRET_NAMESPACE
+              value: "{{ .Release.Namespace }}"
+            - name: TOKEN_SECRET_NAME
+              value: "{{ .Values.metal_console.token_secret_ref.name }}"
+            - name: TOKEN_SECRET_KEY
+              value: "{{ .Values.metal_console.token_secret_ref.key }}"
+{{- if .Values.set_resource_limits }}
+            resources:
+{{ toYaml .Values.resources.metal_console | indent 14 }}
+{{- end }}
+{{- end }}
diff --git a/charts/metal-control-plane/templates/metal-console.yaml b/charts/metal-control-plane/templates/metal-console.yaml
index da40e4a..3b5ed6c 100644
--- a/charts/metal-control-plane/templates/metal-console.yaml
+++ b/charts/metal-control-plane/templates/metal-console.yaml
@@ -54,21 +54,23 @@ spec:
           value: "10001"
         - name: METAL_CONSOLE_METAL_API_URL
           value: http://metal-api:{{ .Values.ports.metal_api }}{{ .Values.metal_api.base_path }}
-        - name: METAL_CONSOLE_HMAC_KEY
-          valueFrom:
-            secretKeyRef:
-              name: metal-api
-              key: admin_key
-        - name: ZAP_ENCODING
-          value: {{ .Values.zap_encoding }}
-        - name: ZAP_LEVEL
-          value: {{ .Values.zap_level }}
+{{ if .Values.metal_apiserver.enabled }}
+        - name: METAL_CONSOLE_METAL_APISERVER_URL
+          value: http://metal-apiserver:{{ .Values.ports.metal_apiserver }}
+        - name: METAL_CONSOLE_TOKEN_FILE
+          value: "/metal/token"
+{{- end }}
         image: {{ .Values.images.metal_console.image }}:{{ .Values.images.metal_console.tag }}
         imagePullPolicy: {{ .Values.images.metal_console.imagePullPolicy }}
         volumeMounts:
           - name: bmc-proxy-certs
             mountPath: /certs
             readOnly: true
+{{ if .Values.metal_apiserver.enabled }}
+          - name: metal-secrets
+            mountPath: /metal
+            readOnly: true
+{{- end }}
         ports:
         - containerPort: 10001
 {{- if .Values.set_resource_limits }}
@@ -79,7 +81,14 @@ spec:
       - name: bmc-proxy-certs
         secret:
           secretName: bmc-proxy-certs
-status: {}
+{{ if .Values.metal_apiserver.enabled }}
+      - name: metal-secrets
+        secret:
+          secretName: "{{ .Values.metal_console.token_secret_ref.name }}"
+          items:
+          - key: "{{ .Values.metal_console.token_secret_ref.key }}"
+            path: token
+{{- end }}
 ---
 apiVersion: v1
 kind: Service
diff --git a/charts/metal-control-plane/values.yaml b/charts/metal-control-plane/values.yaml
index 04ff436..8bcaf44 100644
--- a/charts/metal-control-plane/values.yaml
+++ b/charts/metal-control-plane/values.yaml
@@ -33,6 +33,10 @@ images:
     image: ghcr.io/metal-stack/metal-console
     imagePullPolicy: IfNotPresent
     tag: latest
+  metal_console_token_refresher:
+    image: ghcr.io/metal-stack/metal-token-refresher
+    imagePullPolicy: IfNotPresent
+    tag: latest
 
 resources:
   metal_api:
@@ -70,6 +74,13 @@ resources:
     limits:
       memory: "128Mi"
       cpu: "60m"
+  metal_console_token_refresher:
+    requests:
+      memory: "32Mi"
+      cpu: "20m"
+    limits:
+      memory: "64Mi"
+      cpu: "40m"
   metal_apiserver:
     requests:
       memory: "200Mi"
@@ -350,6 +361,12 @@ metal_console:
       client_key_enc: ""
       client_cert_enc: ""
       ca_cert_enc: ""
+  token_secret_ref:
+    name: metal-console-token
+    key: token
+
+  token_refresher:
+    schedule: "@hourly"
 
 ingress_public_dns:
 v2_ingress_public_dns: