diff --git a/helm/kagent/templates/modelconfig.yaml b/helm/kagent/templates/modelconfig.yaml
index 4c7651e51..e6dcc9a4c 100644
--- a/helm/kagent/templates/modelconfig.yaml
+++ b/helm/kagent/templates/modelconfig.yaml
@@ -26,6 +26,10 @@ spec:
   defaultHeaders:
     {{- toYaml $model.defaultHeaders | nindent 4 }}
   {{- end }}
+  {{- if $model.tls }}
+  tls:
+    {{- toYaml $model.tls | nindent 4 }}
+  {{- end }}
   {{- if $model.config }}
   {{ $dot.Values.providers.default }}:
   {{- toYaml $model.config | nindent 4 }}
diff --git a/helm/kagent/tests/modelconfig_test.yaml b/helm/kagent/tests/modelconfig_test.yaml
index f71ec2cf2..c85f28b55 100644
--- a/helm/kagent/tests/modelconfig_test.yaml
+++ b/helm/kagent/tests/modelconfig_test.yaml
@@ -89,6 +89,29 @@ tests:
           path: spec.model
           value: "gpt-4-turbo"
 
+  - it: should render provider tls configuration
+    set:
+      providers:
+        openAI:
+          tls:
+            disableVerify: true
+            caCertSecretRef: custom-ca
+            caCertSecretKey: ca.crt
+            disableSystemCAs: true
+    asserts:
+      - equal:
+          path: spec.tls.disableVerify
+          value: true
+      - equal:
+          path: spec.tls.caCertSecretRef
+          value: custom-ca
+      - equal:
+          path: spec.tls.caCertSecretKey
+          value: ca.crt
+      - equal:
+          path: spec.tls.disableSystemCAs
+          value: true
+
   - it: should have correct labels
     asserts:
       - equal:
@@ -113,4 +136,4 @@ tests:
     asserts:
       - equal:
           path: metadata.namespace
-          value: custom-namespace 
\ No newline at end of file
+          value: custom-namespace
diff --git a/helm/kagent/values.yaml b/helm/kagent/values.yaml
index 3cc24721f..6d29dffad 100644
--- a/helm/kagent/values.yaml
+++ b/helm/kagent/values.yaml
@@ -426,6 +426,13 @@ providers:
     apiKeySecretRef: kagent-openai
     apiKeySecretKey: OPENAI_API_KEY
     # apiKey: ""
+    # Optional TLS settings for the generated ModelConfig.
+    # This same block can be used under any provider.
+    # tls:
+    #   disableVerify: false
+    #   caCertSecretRef: ""
+    #   caCertSecretKey: ""
+    #   disableSystemCAs: false
   ollama:
     provider: Ollama
     model: "llama3.2"