diff --git a/charts/capsule/README.md b/charts/capsule/README.md
index 8830b6000..e910c2923 100644
--- a/charts/capsule/README.md
+++ b/charts/capsule/README.md
@@ -135,7 +135,7 @@ The following Values have changed key or Value:
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
 | manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
-| manager.options.impersonation | object | `{}` | Impersonation |
+| manager.options.impersonation | object | `{"tenantDefaultServiceAccount":"default"}` | Impersonation |
 | manager.options.labels | object | `{}` | Additional labels to add to the CapsuleConfiguration resource |
 | manager.options.leaderElection.enabled | bool | `true` | Enable Leader Election for capsule controller |
 | manager.options.leaderElection.leaseDuration | string | `""` | Leader election lease duration. Empty uses controller-runtime's default. |
diff --git a/charts/capsule/values.schema.json b/charts/capsule/values.schema.json
index c72502b68..d7e12dfd0 100644
--- a/charts/capsule/values.schema.json
+++ b/charts/capsule/values.schema.json
@@ -471,7 +471,13 @@
                         },
                         "impersonation": {
                             "description": "Impersonation",
-                            "type": "object"
+                            "type": "object",
+                            "properties": {
+                                "tenantDefaultServiceAccount": {
+                                    "type": "string"
+                                }
+                            },
+                            "additionalProperties": true
                         },
                         "labels": {
                             "description": "Additional labels to add to the CapsuleConfiguration resource",
diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml
index 56f4e0d8a..a3f213210 100644
--- a/charts/capsule/values.yaml
+++ b/charts/capsule/values.yaml
@@ -300,8 +300,17 @@ manager:
       deleter: capsule-namespace-deleter
       # -- Name for the ClusterRole required to grant Namespace Provision permissions.
       provisioner: capsule-namespace-provisioner
+
+    # @schema type: object
+    # @schema additionalProperties: true
     # -- Impersonation
-    impersonation: {}
+    impersonation:
+      # Default ServiceAccount for tenant resources (TenantResource) [Namespaced Scope]
+      # When defined, users are required to use this ServiceAccount anywhere in the cluster
+      # unless they explicitly provide their own. Once this is set, Capsule will add this ServiceAccount
+      # for all GlobalTenantResources, if they don't already have a ServiceAccount defined.
+      tenantDefaultServiceAccount: "default"
+
     # Tracing Configuration
     tracing:
       # -- Enable OpenTelemetry tracing for admission webhook requests.