diff --git a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
index 425d93bea..dd5778e25 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
@@ -19,8 +19,15 @@
   {{- $access_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
   {{- $secret_key_admin = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
-{{- $access_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
-{{- $secret_key_read := include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- $access_key_read := "" -}}
+{{- $secret_key_read := "" -}}
+{{- if and (dig "credentials" "read" "accessKey" "" .Values.s3) (dig "credentials" "read" "secretKey" "" .Values.s3) -}}
+  {{- $access_key_read = .Values.s3.credentials.read.accessKey -}}
+  {{- $secret_key_read = .Values.s3.credentials.read.secretKey -}}
+{{- else -}}
+  {{- $access_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+  {{- $secret_key_read = include "getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
+{{- end -}}
 apiVersion: v1
 kind: Secret
 type: Opaque
diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml
index cb1592093..bd8c0b588 100644
--- a/k8s/charts/seaweedfs/values.yaml
+++ b/k8s/charts/seaweedfs/values.yaml
@@ -890,13 +890,16 @@ filer:
     # set to the name of an existing kubernetes Secret with the s3 json config file
     # should have a secret key called seaweedfs_s3_config with an inline json configure
     existingConfigSecret: null
-    # Optionally provide explicit admin credentials for the S3 gateway.
-    # When set, these are used as the admin identity in the generated s3 secret
-    # instead of auto-generating random credentials.
+    # Optionally provide explicit credentials for the S3 gateway.
+    # When set, these are used in the generated s3 secret instead of
+    # auto-generating random credentials.
     # credentials:
     #   admin:
     #     accessKey: ""
     #     secretKey: ""
+    #   read:
+    #     accessKey: ""
+    #     secretKey: ""
     auditLogConfig: {}
     # You may specify buckets to be created during the install or upgrade process.
     # Buckets may be exposed publicly by setting `anonymousRead` to `true`
@@ -925,13 +928,16 @@ s3:
   # set to the name of an existing kubernetes Secret with the s3 json config file
   # should have a secret key called seaweedfs_s3_config with an inline json config
   existingConfigSecret: null
-  # Optionally provide explicit admin credentials for the S3 gateway.
-  # When set, these are used as the admin identity in the generated s3 secret
-  # instead of auto-generating random credentials.
+  # Optionally provide explicit credentials for the S3 gateway.
+  # When set, these are used in the generated s3 secret instead of
+  # auto-generating random credentials.
   # credentials:
   #   admin:
   #     accessKey: ""
   #     secretKey: ""
+  #   read:
+  #     accessKey: ""
+  #     secretKey: ""
   auditLogConfig: {}
   # You may specify buckets to be created during the install or upgrade process.
   # Buckets may be exposed publicly by setting `anonymousRead` to `true`
@@ -1435,13 +1441,16 @@ allInOne:
     # Set to the name of an existing kubernetes Secret with the s3 json config file
     # should have a secret key called seaweedfs_s3_config with an inline json config
     existingConfigSecret: null
-    # Optionally provide explicit admin credentials for the S3 gateway.
-    # When set, these are used as the admin identity in the generated s3 secret
-    # instead of auto-generating random credentials.
+    # Optionally provide explicit credentials for the S3 gateway.
+    # When set, these are used in the generated s3 secret instead of
+    # auto-generating random credentials.
     # credentials:
     #   admin:
     #     accessKey: ""
     #     secretKey: ""
+    #   read:
+    #     accessKey: ""
+    #     secretKey: ""
     auditLogConfig: null  # S3 audit log configuration (null inherits from s3.auditLogConfig)
     # You may specify buckets to be created during the install process.
     # Buckets may be exposed publicly by setting `anonymousRead` to `true`