diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md
index 2405d23..7feae99 100644
--- a/charts/spire-nested/README.md
+++ b/charts/spire-nested/README.md
@@ -315,6 +315,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled`                      | Disable only when you have another instance on the k8s cluster with webhooks enabled.                                                             | `false`                      |
 | `external-root-spire-server-full.controllerManager.className`                                                   | specify to use an explicit class name.                                                                                                            | `spire-mgmt-external-server` |
 | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled`           | Enable child servers                                                                                                                              | `true`                       |
+| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels`            | Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager.     | `{}`                         |
 | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled`                 | Enable the default cluster spiffe id                                                                                                              | `false`                      |
 | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity                                                                                                                     | `false`                      |
 | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled`               | Enable the test-keys identity                                                                                                                     | `false`                      |
diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml
index f380094..7785981 100644
--- a/charts/spire-nested/values.yaml
+++ b/charts/spire-nested/values.yaml
@@ -280,6 +280,9 @@ external-root-spire-server-full:
         child-servers:
           ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
           enabled: true
+          ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.labels [object] Default label spire.spiffe.io/child-server is set to enable label-based informer filtering on the root cluster's external controller manager.
+          labels:
+            spire.spiffe.io/child-server: "true"
         default:
           ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
           enabled: false