diff --git a/base/rhbk/sso-keycloak.yaml.tpl b/base/rhbk/sso-keycloak.yaml.tpl
index 7d4c01a..339fa6a 100644
--- a/base/rhbk/sso-keycloak.yaml.tpl
+++ b/base/rhbk/sso-keycloak.yaml.tpl
@@ -35,3 +35,11 @@ spec:
           - args:
               - start-dev
   instances: 1
+  additionalOptions:
+    - name: https-client-auth
+      value: request
+  truststores:
+    shared-certs-ca:
+      secret:
+        name: rhbk-client-ca
+        optional: true