diff --git a/charts/spire/README.md b/charts/spire/README.md
index 99861fd..61eb9c5 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -228,6 +228,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `global.spire.namespaces.server.labels`          | Labels to apply to the Spire server Namespace.                                                                                                                                                                                         | `{}`              |
 | `global.spire.strictMode`                        | Check values, such as trustDomain, are overridden with a suitable value for production.                                                                                                                                                | `false`           |
 | `global.spire.ingressControllerType`             | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""`              |
+| `global.spire.tools.kubectl.tag`                 | Set to force the tag to use for all kubectl instances                                                                                                                                                                                  | `""`              |
 | `global.installAndUpgradeHooks.enabled`          | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)                                                                                                                             | `true`            |
 | `global.deleteHooks.enabled`                     | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)                                                                                                                                      | `true`            |
 
diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl
index 5ecde0a..239efc1 100644
--- a/charts/spire/templates/_spire-lib.tpl
+++ b/charts/spire/templates/_spire-lib.tpl
@@ -168,12 +168,16 @@ rules:
 {{- end }}
 
 {{- define "spire-lib.kubectl-image" }}
-{{- $root := deepCopy . }}
-{{- $tag := $root.image.tag | toString }}
-{{- if eq (len $tag) 0 }}
-{{- $_ := set $root.image "tag" (regexReplaceAll "^(v?\\d+\\.\\d+\\.\\d+).*" $root.KubeVersion "${1}") }}
-{{- end }}
-{{- include "spire-lib.image" $root }}
+{{-   $root := deepCopy . }}
+{{-   $tag := $root.image.tag | toString }}
+{{-   if eq (len $tag) 0 }}
+{{-      if dig "spire" "tools" "kubectl" "tag" "" $root.global }}
+{{-        $_ := set $root.image "tag" $root.global.spire.tools.kubectl.tag }}
+{{-      else }}
+{{-        $_ := set $root.image "tag" (regexReplaceAll "^(v?\\d+\\.\\d+\\.\\d+).*" $root.KubeVersion "${1}") }}
+{{-     end }}
+{{-   end }}
+{{-   include "spire-lib.image" $root }}
 {{- end }}
 
 {{/*
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 1255884..ff2deb2 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -69,6 +69,11 @@ global:
     ## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
     ingressControllerType: ""
 
+    tools:
+      kubectl:
+        ## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
+        tag: ""
+
   installAndUpgradeHooks:
     ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
     enabled: true