diff --git a/helm/charts/keto/README.md b/helm/charts/keto/README.md
index f6af708cb..a142bae6b 100644
--- a/helm/charts/keto/README.md
+++ b/helm/charts/keto/README.md
@@ -149,6 +149,7 @@ Access Control Policies as a Server
 | service.read.appProtocol | string | `"grpc"` |  |
 | service.read.clusterIP | string | `""` |  |
 | service.read.enabled | bool | `true` |  |
+| service.read.headless.enabled | bool | `true` |  |
 | service.read.loadBalancerIP | string | `""` |  |
 | service.read.name | string | `"grpc-read"` |  |
 | service.read.port | int | `80` |  |
@@ -156,6 +157,7 @@ Access Control Policies as a Server
 | service.write.appProtocol | string | `"grpc"` |  |
 | service.write.clusterIP | string | `""` |  |
 | service.write.enabled | bool | `true` |  |
+| service.write.headless.enabled | bool | `true` |  |
 | service.write.loadBalancerIP | string | `""` |  |
 | service.write.name | string | `"grpc-write"` |  |
 | service.write.port | int | `80` |  |
diff --git a/helm/charts/keto/templates/service-read.yaml b/helm/charts/keto/templates/service-read.yaml
index dd2bd89a7..b86a615fa 100644
--- a/helm/charts/keto/templates/service-read.yaml
+++ b/helm/charts/keto/templates/service-read.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.service.read.enabled }}
+---
 apiVersion: v1
 kind: Service
 metadata:
@@ -30,4 +31,30 @@ spec:
   selector:
     app.kubernetes.io/name: {{ include "keto.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
-{{ end }}
\ No newline at end of file
+{{- if .Values.service.read.headless.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "keto.fullname" . }}-read-headless
+  {{- if .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    service.ory.sh/type: headless
+    app.kubernetes.io/component: read
+    {{- include "keto.labels" . | nindent 4 }}
+spec:
+  type: "ClusterIP"
+  clusterIP: "None"
+  ports:
+    - port: {{ .Values.keto.config.serve.read.port }}
+      targetPort: {{ .Values.service.read.name }}
+      protocol: TCP
+      name: {{ .Values.service.read.name }}
+      appProtocol: {{ .Values.service.read.appProtocol }}
+  selector:
+    app.kubernetes.io/name: {{ include "keto.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm/charts/keto/templates/service-write.yaml b/helm/charts/keto/templates/service-write.yaml
index 474cfae3a..d4dab787a 100644
--- a/helm/charts/keto/templates/service-write.yaml
+++ b/helm/charts/keto/templates/service-write.yaml
@@ -30,4 +30,30 @@ spec:
   selector:
     app.kubernetes.io/name: {{ include "keto.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
-{{ end }}
\ No newline at end of file
+{{- if .Values.service.write.headless.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "keto.fullname" . }}-write-headless
+  {{- if .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    service.ory.sh/type: headless
+    app.kubernetes.io/component: write
+    {{- include "keto.labels" . | nindent 4 }}
+spec:
+  type: "ClusterIP"
+  clusterIP: "None"
+  ports:
+    - port: {{ .Values.keto.config.serve.write.port }}
+      targetPort: {{ .Values.service.write.name }}
+      protocol: TCP
+      name: {{ .Values.service.write.name }}
+      appProtocol: {{ .Values.service.write.appProtocol }}
+  selector:
+    app.kubernetes.io/name: {{ include "keto.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm/charts/keto/values.yaml b/helm/charts/keto/values.yaml
index 8933bdedd..5c3e181db 100644
--- a/helm/charts/keto/values.yaml
+++ b/helm/charts/keto/values.yaml
@@ -183,6 +183,9 @@ service:
     name: grpc-read
     port: 80
     appProtocol: grpc
+    ## -- Enable extra headless service
+    headless:
+      enabled: true
   ## -- Write service
   write:
     enabled: true
@@ -193,6 +196,9 @@ service:
     name: grpc-write
     port: 80
     appProtocol: grpc
+    ## -- Enable extra headless service
+    headless:
+      enabled: true
   ## -- Metrics service
   metrics:
     enabled: false