diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index e8ae52c..5b76907 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -405,6 +405,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `agentTTL`                                                                                   | The TTL to use for agent SVIDs. If unset, the defaultX509SvidTTL will be used.                                                                                                                                                                                                                                                                                                                       | `""`                                                                                           |
 | `defaultX509SvidTTL`                                                                         | TTL for X509 Svids                                                                                                                                                                                                                                                                                                                                                                                   | `4h`                                                                                           |
 | `defaultJwtSvidTTL`                                                                          | TTL for JWT Svids                                                                                                                                                                                                                                                                                                                                                                                    | `1h`                                                                                           |
+| `rateLimit.attestation`                                                                      | Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable.                                                                                                                                                                                                                                                                | `true`                                                                                         |
+| `rateLimit.signing`                                                                          | Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery.                                                                                                                                | `true`                                                                                         |
 | `pruneAttestedNodesExpiredFor`                                                               | Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.                                                                                                             | `""`                                                                                           |
 | `pruneTOFUNodes`                                                                             | If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.                                                                                                                                                                                                                                                      | `false`                                                                                        |
 | `nodeAttestor.k8sPSAT.enabled`                                                               | Enable PSAT k8s nodeattestor                                                                                                                                                                                                                                                                                                                                                                         | `true`                                                                                         |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 283ae7c..9fd4e76 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -120,6 +120,11 @@ server:
     {{- end }}
   {{- end }}
   {{- end }}
+  {{- with .Values.rateLimit }}
+  ratelimit:
+    attestation: {{ .attestation }}
+    signing: {{ .signing }}
+  {{- end }}
 
 plugins:
   {{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 1fbb497..f4677b7 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -999,6 +999,12 @@ defaultX509SvidTTL: 4h
 ## @param defaultJwtSvidTTL TTL for JWT Svids
 defaultJwtSvidTTL: 1h
 
+## @param rateLimit.attestation Enable rate limiting for node attestation. When true, rate limits node attestation to 1 per second globally. Set to false to disable.
+## @param rateLimit.signing Enable rate limiting for SVID signing (BatchNewX509SVID, BatchNewJWTSVID). When true, rate limits signing to 500 requests per second per server pod. Set to false to disable. Disabling is appropriate when running many replicas or during thundering-herd recovery.
+rateLimit:
+  attestation: true
+  signing: true
+
 ## @param pruneAttestedNodesExpiredFor Enables periodic pruning of attested node entries with expired SVIDs. Set to a duration (e.g. "168h" for 7 days) to prune nodes that expired longer ago than the specified duration. Set to "" (empty) to disable pruning. When enabled, expired nodes are pruned at a regular interval.
 pruneAttestedNodesExpiredFor: ""
 ## @param pruneTOFUNodes If true, includes non-reattestable (TOFU) nodes in the pruning process when pruneAttestedNodesExpiredFor is set. Banned nodes are never pruned.