diff --git a/charts/pulsar/templates/tls-cert-internal-issuer.yaml b/charts/pulsar/templates/tls-cert-internal-issuer.yaml
index cecc665b..f2d33aef 100644
--- a/charts/pulsar/templates/tls-cert-internal-issuer.yaml
+++ b/charts/pulsar/templates/tls-cert-internal-issuer.yaml
@@ -45,6 +45,10 @@ spec:
     - server auth
     - client auth
   isCA: true
+{{- if .Values.certs.internal_issuer.privateKey }}
+  privateKey:
+    {{- toYaml .Values.certs.internal_issuer.privateKey | nindent 4 }}
+{{- end }}
   issuerRef:
     name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}"
     # We can reference ClusterIssuers by changing the kind here.
diff --git a/charts/pulsar/values.yaml b/charts/pulsar/values.yaml
index e206bfaa..772f2826 100755
--- a/charts/pulsar/values.yaml
+++ b/charts/pulsar/values.yaml
@@ -495,6 +495,13 @@ certs:
     duration: 2160h
     # 15d
     renewBefore: 360h
+    # Private key settings for the self-signed CA certificate.
+    # Keep rotationPolicy at Never so the CA key survives renewals. Since
+    # cert-manager 1.18 the default is Always, which generates a new CA key
+    # on every renewal and invalidates all certificates issued by the old key
+    # until each of them has been re-issued.
+    privateKey:
+      rotationPolicy: Never
   issuers:
     # Used for certs.internal_issuer.type as selfsigning
     selfsigning: