diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml
index 52d30e913..67022a402 100644
--- a/control-plane/roles/metal/defaults/main.yaml
+++ b/control-plane/roles/metal/defaults/main.yaml
@@ -52,6 +52,11 @@ metal_apiserver_oidc_client_id: "{{ lookup('k8s', api_version='v1', namespace=me
 metal_apiserver_oidc_client_secret: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='zitadel-client-credentials').data.client_secret | default('') | b64decode }}"
 metal_apiserver_session_secret: secret
 metal_apiserver_admin_subjects: []
+metal_apiserver_headscale_enabled: false
+metal_apiserver_headscale_tls: yes
+metal_apiserver_headscale_api_key: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='headscale-api-key').get('data', {}).get('key') | b64decode if metal_apiserver_headscale_enabled else '' }}"
+metal_apiserver_headscale_control_plane_address: "http{{ 's' if metal_apiserver_headscale_tls }}://headscale.{{ metal_control_plane_ingress_dns }}"
+metal_apiserver_headscale_internal_api_address: "headscale:50443"
 
 # metal-api
 metal_api_image_pull_policy: "{{ metal_control_plane_image_pull_policy }}"
diff --git a/control-plane/roles/metal/templates/metal-values.j2 b/control-plane/roles/metal/templates/metal-values.j2
index 230424d6d..10da33f6e 100644
--- a/control-plane/roles/metal/templates/metal-values.j2
+++ b/control-plane/roles/metal/templates/metal-values.j2
@@ -247,6 +247,11 @@ metal_apiserver:
       user: {{ metal_apiserver_auditing_timescaledb_user }}
       password: {{ metal_apiserver_auditing_timescaledb_password }}
       retention: {{ metal_apiserver_auditing_timescaledb_retention }}
+  headscale:
+    enabled: {{ 'true' if metal_apiserver_headscale_enabled else 'false' }}
+    api_key: "{{ metal_apiserver_headscale_api_key }}"
+    control_plane_address: "{{ metal_apiserver_headscale_control_plane_address }}"
+    internal_api_address: "{{ metal_apiserver_headscale_internal_api_address }}"
   rateLimit:
     maxRequestsPerMinute: {{ metal_apiserver_rate_limiting_max_requests_per_minute }}
     maxUnauthenticatedRequestsPerMinute: {{ metal_apiserver_rate_limiting_max_unauthenticated_requests_per_minute }}