diff --git a/deploy/charts/buzz-push-gateway/tests/render.sh b/deploy/charts/buzz-push-gateway/tests/render.sh
index 0c47634a2..b896a93e0 100755
--- a/deploy/charts/buzz-push-gateway/tests/render.sh
+++ b/deploy/charts/buzz-push-gateway/tests/render.sh
@@ -75,6 +75,15 @@ assert route['spec']['parentRefs']
 assert 'push.buzz.xyz' in route['spec']['hostnames']
 PY
 
+# Legacy token-auth values must fail rather than silently selecting the default
+# certificate Secret.
+if helm template push deploy/charts/buzz-push-gateway \
+  --set apnsKey.secretName=legacy-apns-secret \
+  --set apnsKey.secretKey=legacy-provider.p8 >/dev/null 2>&1; then
+  echo 'expected legacy apnsKey values to fail schema validation' >&2
+  exit 1
+fi
+
 # Enabling a route without a Gateway attachment must fail schema validation.
 if helm template push deploy/charts/buzz-push-gateway --set httpRoute.enabled=true >/dev/null 2>&1; then
   echo 'expected httpRoute.enabled=true without parentRefs to fail' >&2
diff --git a/deploy/charts/buzz-push-gateway/values.schema.json b/deploy/charts/buzz-push-gateway/values.schema.json
index 631a04aea..6e8d9908e 100644
--- a/deploy/charts/buzz-push-gateway/values.schema.json
+++ b/deploy/charts/buzz-push-gateway/values.schema.json
@@ -23,6 +23,25 @@
       "type": "string",
       "minLength": 1
     },
+    "apnsCert": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "secretName",
+        "secretKey"
+      ],
+      "properties": {
+        "secretName": {
+          "type": "string",
+          "minLength": 1
+        },
+        "secretKey": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "apnsKey": false,
     "httpRoute": {
       "type": "object",
       "required": [
@@ -238,6 +257,7 @@
     "publicDeliveryUrl",
     "maxGrantLifetimeSeconds",
     "appAttestAppId",
+    "apnsCert",
     "httpRoute",
     "image",
     "migration"