diff --git a/charts/tailscale/templates/install.yaml b/charts/tailscale/templates/install.yaml
index d9f7e17..c247191 100644
--- a/charts/tailscale/templates/install.yaml
+++ b/charts/tailscale/templates/install.yaml
@@ -12,6 +12,17 @@
     requests:
       storage: 1Gi
 ---
+apiVersion: headscale.dodo.cloud/v1
+kind: HeadscaleUser
+metadata:
+  name: {{ .Values.username }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  name: {{ .Values.username }}
+  preAuthKey:
+    enabled: true
+    secretName: {{ .Values.preAuthKeySecret }}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -45,8 +56,17 @@
           value: ""
         - name: TS_STATE_DIR
           value: /tailscale-state
+        - name: TS_AUTHKEY
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.preAuthKeySecret }}
+              key: key
+        - name: TS_HOSTNAME
+          value: {{ .Values.hostname }}
+        - name: TS_ROUTES
+          value: {{ .Values.ipSubnet }}
         - name: TS_EXTRA_ARGS
-          value: --hostname={{ .Values.hostname }} --login-server={{ .Values.loginServer }} --advertise-routes={{ .Values.ipSubnet }}
+          value: --hostname= --login-server={{ .Values.loginServer }}
         volumeMounts:
         - name: tailscale
           mountPath: /tailscale-state
diff --git a/charts/tailscale/values.yaml b/charts/tailscale/values.yaml
index 8f8b7e7..6ae525f 100644
--- a/charts/tailscale/values.yaml
+++ b/charts/tailscale/values.yaml
@@ -2,6 +2,8 @@
   repository: tailscale/tailscale
   tag: v1.42.0
   pullPolicy: IfNotPresent
+username: example
 hostname: example-ingress
 loginServer: headscale.example.com
 ipSubnet: 10.1.0.1/24
+preAuthKeySecret: example-key