diff --git a/assets/translations/en-us.yaml b/assets/translations/en-us.yaml
index c5eb26e51f..75295c52e8 100644
--- a/assets/translations/en-us.yaml
+++ b/assets/translations/en-us.yaml
@@ -4228,6 +4228,8 @@ advancedSettings:
     'cluster-template-enforcement': 'Non-admins will be restricted to launching clusters via preapproved RKE Templates only.'
     'auth-user-session-ttl-minutes': 'Custom TTL (in minutes) on a user auth session.'
     'auth-token-max-ttl-minutes': 'Custom max TTL (in minutes) on an auth token.'
+    'kubeconfig-generate-token': 'Automatically generate kubeconfig tokens for users.'
+    'kubeconfig-token-ttl-minutes': 'Custom max TTL (in minutes) on a kubeconfig token.'
     'rke-metadata-config': 'Configure RKE metadata refresh parameters.'
     'ui-banners': 'Classification banner is used to display a custom fixed banner in the header, footer, or both.'
     'ui-default-landing': 'The default page users land on after login.'
diff --git a/config/settings.js b/config/settings.js
index 15a1523f82..3949806e52 100644
--- a/config/settings.js
+++ b/config/settings.js
@@ -27,6 +27,8 @@ export const SETTING = {
   HIDE_LOCAL_CLUSTER:               'hide-local-cluster',
   // CLUSTER_DEFAULTS:              'cluster-defaults',
   AUTH_TOKEN_MAX_TTL_MINUTES:       'auth-token-max-ttl-minutes',
+  KUBECONFIG_GENERATE_TOKEN:        'kubeconfig-generate-token',
+  KUBECONFIG_TOKEN_TTL_MINUTES:     'kubeconfig-token-ttl-minutes',
   ENGINE_URL:                       'engine-install-url',
   ENGINE_ISO_URL:                   'engine-iso-url',
   FIRST_LOGIN:                      'first-login',
@@ -63,6 +65,8 @@ export const ALLOWED_SETTINGS = {
   [SETTING.AUTH_USER_INFO_MAX_AGE_SECONDS]: {},
   [SETTING.AUTH_USER_SESSION_TTL_MINUTES]:  {},
   [SETTING.AUTH_TOKEN_MAX_TTL_MINUTES]:     {},
+  [SETTING.KUBECONFIG_GENERATE_TOKEN]:      { kind: 'boolean' },
+  [SETTING.KUBECONFIG_TOKEN_TTL_MINUTES]:   {},
   [SETTING.AUTH_USER_INFO_RESYNC_CRON]:     {},
   [SETTING.SERVER_URL]:                     { kind: 'url' },
   [SETTING.RKE_METADATA_CONFIG]:            { kind: 'json' },