diff --git a/docs/docs/20-admins/30-operation/80-user-management.md b/docs/docs/20-admins/30-operation/80-user-management.md
index 3ac357cac6..513d6febe5 100644
--- a/docs/docs/20-admins/30-operation/80-user-management.md
+++ b/docs/docs/20-admins/30-operation/80-user-management.md
@@ -10,7 +10,11 @@ Renku uses [Keycloak](https://www.keycloak.org/) as its identity provider. When
 
 ### Accessing Keycloak Admin Console
 
-1. Navigate to your Keycloak instance (at `https://<your-domain>/auth`)
+:::warning
+By default, the Keycloak Admin Console is publicly accessible. We recommend restricting access. Setting `global.keycloak.secureAdminConsole=true` in your Renku Helm values limits access to port-forwarding only (port `8080` on the Keycloak pod), blocking public URL access.
+:::
+
+1. Navigate to your Keycloak instance (at `https://<your-domain>/auth`, or `http://localhost:8080` if `global.keycloak.secureAdminConsole=true` is set and you have port-forwarded)
 2. Click on "Administration Console"
 3. Log in with your admin credentials
 4. Select the Renku realm to manage users and roles
diff --git a/helm-chart/renku/templates/keycloak-admin-console.yaml b/helm-chart/renku/templates/keycloak-admin-console.yaml
new file mode 100644
index 0000000000..7140fbcf35
--- /dev/null
+++ b/helm-chart/renku/templates/keycloak-admin-console.yaml
@@ -0,0 +1,19 @@
+---
+{{- if .Values.keycloakx.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: keycloak-admin-console
+  labels:
+    app: {{ template "renku.name" . }}
+    chart: {{ template "renku.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade,pre-rollback
+    helm.sh/hook-delete-policy: before-hook-creation
+data:
+  {{- if .Values.global.keycloak.secureAdminConsole }}
+  KC_HOSTNAME_ADMIN_URL: http://localhost:8080
+  {{- end }}
+{{- end }}
diff --git a/helm-chart/renku/values.yaml b/helm-chart/renku/values.yaml
index 0a1c4410b1..e827bc5a69 100644
--- a/helm-chart/renku/values.yaml
+++ b/helm-chart/renku/values.yaml
@@ -48,6 +48,8 @@ global:
     url:
     ## Explicitly set another realm than "renku" here
     realm:
+    ## Secure the Keycloak admin console by limiting access to localhost. We recommend enabling this. The admin console can still be accessed by port-forwarding the pod on port 8080.
+    secureAdminConsole: false
   gateway:
     ## Client secret of the renku client application registered in keycloak.
     ## Should be set to a proper value (i.e. by using openssl rand -hex 32) for production.
@@ -305,6 +307,8 @@ keycloakx:
         name: renku-keycloak-postgres
     - secretRef:
         name: keycloak-password-secret
+    - configMapRef:
+        name: keycloak-admin-console
   extraVolumeMounts: |
     - name: theme
       mountPath: /opt/keycloak/themes/renku-theme