diff --git a/cluster/pulumi/infra/src/config.ts b/cluster/pulumi/infra/src/config.ts
index 3d42081c5d..a82d449669 100644
--- a/cluster/pulumi/infra/src/config.ts
+++ b/cluster/pulumi/infra/src/config.ts
@@ -60,6 +60,7 @@ export const InfraConfigSchema = z.object({
         initialConnectionWindowSize: z.int(),
       }),
     }),
+    enableSweetSecurity: z.boolean().default(false),
     extraCustomResources: z.object({}).catchall(z.any()).default({}),
   }),
   cloudArmor: CloudArmorConfigSchema,
diff --git a/cluster/pulumi/infra/src/index.ts b/cluster/pulumi/infra/src/index.ts
index 10b83d3b17..cac6cdc412 100644
--- a/cluster/pulumi/infra/src/index.ts
+++ b/cluster/pulumi/infra/src/index.ts
@@ -5,6 +5,7 @@ import * as k8s from '@pulumi/kubernetes';
 import { config } from '@canton-network/splice-pulumi-common';
 import { svsConfig } from '@canton-network/splice-pulumi-common-sv/src/config';
 
+import { configureSweet } from '../sweet';
 import { configureAuth0 } from './auth0';
 import { configureCloudArmorPolicy } from './cloudArmor';
 import {
@@ -64,6 +65,10 @@ configureStorage();
 
 configureReloader();
 
+if (infraConfig.enableSweetSecurity) {
+  configureSweet();
+}
+
 installExtraCustomResources();
 
 if (enableGCReaperJob) {
diff --git a/cluster/pulumi/infra/sweet.ts b/cluster/pulumi/infra/sweet.ts
new file mode 100644
index 0000000000..67cf473f88
--- /dev/null
+++ b/cluster/pulumi/infra/sweet.ts
@@ -0,0 +1,61 @@
+// Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import * as gcp from '@pulumi/gcp';
+import * as k8s from '@pulumi/kubernetes';
+import {
+  HELM_MAX_HISTORY_SIZE,
+  exactNamespace,
+  infraKubernetesScheduling,
+} from '@canton-network/splice-pulumi-common';
+
+export function configureSweet(): k8s.helm.v3.Release {
+  const operatorNs = exactNamespace('sweet-operator', false, false);
+  const sweetNs = exactNamespace('sweet', false, false);
+
+  const apiKey = gcp.secretmanager.getSecretVersionOutput({
+    secret: 'sweet-api-key',
+  }).secretData;
+  const secret = gcp.secretmanager.getSecretVersionOutput({
+    secret: 'sweet-secret',
+  }).secretData;
+
+  return new k8s.helm.v3.Release(
+    'sweet-operator',
+    {
+      name: 'sweet-operator',
+      chart: 'oci://registry.sweet.security/helm/operatorchart',
+      version: '1.0.265090+06a1b12d61fc35ceb20b350388f7e812d382e4b2',
+      namespace: sweetNs.ns.metadata.name,
+      values: {
+        sweet: {
+          apiKey,
+          secret,
+        },
+        operator: {
+          ...infraKubernetesScheduling,
+        },
+        frontier: {
+          extraValues: {
+            informer: {
+              ...infraKubernetesScheduling,
+            },
+          }
+        },
+        admiral: {
+          extraValues: {
+            admirald: {
+              ...infraKubernetesScheduling,
+            },
+          },
+        }
+      },
+      maxHistory: HELM_MAX_HISTORY_SIZE,
+    },
+    {
+      dependsOn: [operatorNs.ns, sweetNs.ns],
+    }
+
+  );
+
+}