diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index 5a867cc..45f0241 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -272,6 +272,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `upstreamAuthority.awsSecret.keyFileArn`                                                                      | ARN or name of the secret containing the intermediate CA private key                                                                                                                                                                                                                                                                                                                                 | `""`                                                                                                        |
 | `upstreamAuthority.awsSecret.bundleFileArn`                                                                   | (Optional) ARN or name of the secret containing the root CA bundle                                                                                                                                                                                                                                                                                                                                   | `""`                                                                                                        |
 | `upstreamAuthority.awsSecret.assumeRoleArn`                                                                   | (Optional) ARN of an IAM role to assume                                                                                                                                                                                                                                                                                                                                                              | `""`                                                                                                        |
+| `upstreamAuthority.gcpCAS.enabled`                                                                            | Flag to enable upstream authority plugin with GCP Certificate Authority Service                                                                                                                                                                                                                                                                                                                      | `false`                                                                                                     |
+| `upstreamAuthority.gcpCAS.projectName`                                                                        | GCP project containing the root CA certificate                                                                                                                                                                                                                                                                                                                                                       | `""`                                                                                                        |
+| `upstreamAuthority.gcpCAS.regionName`                                                                         | GCP region name (e.g., us-central1)                                                                                                                                                                                                                                                                                                                                                                  | `""`                                                                                                        |
+| `upstreamAuthority.gcpCAS.caPool`                                                                             | Name of the CA Pool that has the root CA certificate                                                                                                                                                                                                                                                                                                                                                 | `""`                                                                                                        |
+| `upstreamAuthority.gcpCAS.labelKey`                                                                           | Label key used to filter and select the relevant CA certificate                                                                                                                                                                                                                                                                                                                                      | `""`                                                                                                        |
+| `upstreamAuthority.gcpCAS.labelValue`                                                                         | Label value used to filter and select the relevant CA certificate                                                                                                                                                                                                                                                                                                                                    | `""`                                                                                                        |
 | `upstreamAuthority.certManager.enabled`                                                                       | Flag to enable upstream authority plugin with cert manager                                                                                                                                                                                                                                                                                                                                           | `false`                                                                                                     |
 | `upstreamAuthority.certManager.rbac.create`                                                                   | Flag to create RBAC roles                                                                                                                                                                                                                                                                                                                                                                            | `true`                                                                                                      |
 | `upstreamAuthority.certManager.issuerName`                                                                    | Defaults to the release name, override if CA is provided outside of the chart                                                                                                                                                                                                                                                                                                                        | `""`                                                                                                        |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 63d9f96..befedbc 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -656,6 +656,22 @@ plugins:
         {{- end }}
   {{- end }}
   {{- end }}
+
+  {{- with .Values.upstreamAuthority.gcpCAS }}
+  {{- if eq (.enabled | toString) "true" }}
+  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
+  UpstreamAuthority:
+    gcp_cas:
+      plugin_data:
+        root_cert_spec:
+          project_name: {{ .projectName | quote }}
+          region_name: {{ .regionName | quote }}
+          ca_pool: {{ .caPool | quote }}
+          label_key: {{ .labelKey | quote }}
+          label_value: {{ .labelValue | quote }}
+  {{- end }}
+  {{- end }}
+
 {{- if gt $upstreamAuthorityUsed 1 }}
 {{- fail "You can only enable a single Upstream Authority." }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 47b0fbc..dd5e7cc 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -551,6 +551,19 @@ upstreamAuthority:
     bundleFileArn: ""
     ## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
     assumeRoleArn: ""
+  gcpCAS:
+    ## @param upstreamAuthority.gcpCAS.enabled Flag to enable upstream authority plugin with GCP Certificate Authority Service
+    enabled: false
+    ## @param upstreamAuthority.gcpCAS.projectName GCP project containing the root CA certificate
+    projectName: ""
+    ## @param upstreamAuthority.gcpCAS.regionName GCP region name (e.g., us-central1)
+    regionName: ""
+    ## @param upstreamAuthority.gcpCAS.caPool Name of the CA Pool that has the root CA certificate
+    caPool: ""
+    ## @param upstreamAuthority.gcpCAS.labelKey Label key used to filter and select the relevant CA certificate
+    labelKey: ""
+    ## @param upstreamAuthority.gcpCAS.labelValue Label value used to filter and select the relevant CA certificate
+    labelValue: ""
   certManager:
     ## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
     enabled: false