diff --git a/charts/spire-lib/templates/_helpers.tpl b/charts/spire-lib/templates/_helpers.tpl
index 6110827..a5e598e 100644
--- a/charts/spire-lib/templates/_helpers.tpl
+++ b/charts/spire-lib/templates/_helpers.tpl
@@ -589,6 +589,10 @@ metadata:
   {{- end }}
 spec:
   gatewayClassName: {{ required "gatewayAPI.gateway.className is required to render the shared Gateway" $obj.className | quote }}
+  {{- with $obj.infrastructure }}
+  infrastructure:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   allowedListeners:
     namespaces:
       from: {{ default "All" $obj.allowedListenersNamespaces }}
diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md
index 2a7db72..e49319d 100644
--- a/charts/spire-nested/README.md
+++ b/charts/spire-nested/README.md
@@ -243,6 +243,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `gatewayAPI.gateway.enabled`                                             | Render the shared Gateway object                                                                                                                                                                                                       | `false`                               |
 | `gatewayAPI.gateway.className`                                           | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.                                                                                                                                                            | `""`                                  |
 | `gatewayAPI.gateway.annotations`                                         | Annotations for the Gateway object                                                                                                                                                                                                     | `{}`                                  |
+| `gatewayAPI.gateway.infrastructure`                                      | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.                                                                                               | `{}`                                  |
 | `gatewayAPI.gateway.allowedListenersNamespaces`                          | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.                                                                                                                                              | `All`                                 |
 | `gatewayAPI.gateway.allowedRoutesNamespaces`                             | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.                                                                                           | `All`                                 |
 | `gatewayAPI.gateway.extraListeners`                                      | Additional listeners to add to the Gateway                                                                                                                                                                                             | `[]`                                  |
diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml
index c5406d9..66b6d28 100644
--- a/charts/spire-nested/values.yaml
+++ b/charts/spire-nested/values.yaml
@@ -138,6 +138,8 @@ gatewayAPI:
     className: ""
     ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
     annotations: {}
+    ## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
+    infrastructure: {}
     ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
     allowedListenersNamespaces: All
     ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
diff --git a/charts/spire/README.md b/charts/spire/README.md
index b6f1423..531abf0 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -328,6 +328,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `gatewayAPI.gateway.enabled`                    | Render the shared Gateway object                                                                                                             | `false` |
 | `gatewayAPI.gateway.className`                  | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.                                                                  | `""`    |
 | `gatewayAPI.gateway.annotations`                | Annotations for the Gateway object                                                                                                           | `{}`    |
+| `gatewayAPI.gateway.infrastructure`             | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.     | `{}`    |
 | `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.                                                    | `All`   |
 | `gatewayAPI.gateway.allowedRoutesNamespaces`    | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All`   |
 | `gatewayAPI.gateway.extraListeners`             | Additional listeners to add to the Gateway                                                                                                   | `[]`    |
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index 0932ec8..5629295 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -159,6 +159,8 @@ gatewayAPI:
     className: ""
     ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
     annotations: {}
+    ## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
+    infrastructure: {}
     ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
     allowedListenersNamespaces: All
     ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go
index c2819bb..6126912 100644
--- a/tests/unit/spire_test.go
+++ b/tests/unit/spire_test.go
@@ -985,4 +985,21 @@ spire-server:
 			Expect(serverResource).Should(ContainSubstring("name: my-ro-db-secret"))
 		})
 	})
+	Describe("gatewayAPI.gateway.infrastructure", func() {
+		It("passes infrastructure through to the shared Gateway spec when set", func() {
+			objs, err := ValueStringRender(chart, `
+gatewayAPI:
+  gateway:
+    enabled: true
+    className: istio
+    infrastructure:
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internal
+`)
+			Expect(err).Should(Succeed())
+			gateway := objs["spire/templates/gateway.yaml"]
+			Expect(gateway).Should(ContainSubstring("infrastructure:"))
+			Expect(gateway).Should(ContainSubstring("service.beta.kubernetes.io/aws-load-balancer-scheme: internal"))
+		})
+	})
 })