diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 5b76907..c1b6133 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -409,6 +409,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `rateLimit.signing`                                                                          | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery.                                                                                                                                | `true`                                                                                         |
 | `pruneAttestedNodesExpiredFor`                                                               | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.                                                                                                             | `""`                                                                                           |
 | `pruneTOFUNodes`                                                                             | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.                                                                                                                                                                                                                                                      | `false`                                                                                        |
+| `maxAttestedNodeInfoStaleness`                                                               | How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m").                                                                                                    | `""`                                                                                           |
 | `nodeAttestor.k8sPSAT.enabled`                                                               | Enable PSAT k8s nodeattestor                                                                                                                                                                                                                                                                                                                                                                         | `true`                                                                                         |
 | `nodeAttestor.k8sPSAT.serviceAccountAllowList`                                               | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used.                                                                                                                                                                                                                                                                                        | `[]`                                                                                           |
 | `nodeAttestor.k8sPSAT.audience`                                                              | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used                                                                                                                                                                                                                                                                                                    | `[]`                                                                                           |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 9fd4e76..eb5f784 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -73,6 +73,9 @@ server:
   {{- if .Values.pruneTOFUNodes }}
   prune_tofu_nodes: {{ .Values.pruneTOFUNodes }}
   {{- end }}
+  {{- if .Values.maxAttestedNodeInfoStaleness }}
+  max_attested_node_info_staleness: {{ .Values.maxAttestedNodeInfoStaleness | quote }}
+  {{- end }}
 
   ca_subject:
     - country: [{{ include "spire-server.ca-subject-country" . | quote }}]
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index f4677b7..a26a598 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -1009,6 +1009,8 @@ rateLimit:
 pruneAttestedNodesExpiredFor: ""
 ## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.
 pruneTOFUNodes: false
+## @param maxAttestedNodeInfoStaleness How long to trust stale cache information about attested nodes. Set to "" to use the SPIRE default (0s). Increasing this can improve performance under high load by reducing datastore reads, at the cost of acting on slightly stale node state. Accepts Go duration strings (e.g. "10s", "1m").
+maxAttestedNodeInfoStaleness: ""
 
 nodeAttestor:
   k8sPSAT: