diff --git a/metropolis/node/kubernetes/pki/kubernetes.go b/metropolis/node/kubernetes/pki/kubernetes.go
index 0c795f2..542c614 100644
--- a/metropolis/node/kubernetes/pki/kubernetes.go
+++ b/metropolis/node/kubernetes/pki/kubernetes.go
@@ -76,6 +76,9 @@
 	//   https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/#ca-reusage-and-conflicts
 	AggregationCA    KubeCertificateName = "aggregation-ca"
 	FrontProxyClient KubeCertificateName = "front-proxy-client"
+	// The Metropolis authentication proxy needs to be able to proxy requests
+	// and assert the established identity to the Kubernetes API server.
+	MetropolisAuthProxyClient KubeCertificateName = "metropolis-auth-proxy-client"
 )
 
 const (
@@ -149,6 +152,7 @@
 		Mode:      opki.CertificateManaged,
 	}
 	make(AggregationCA, FrontProxyClient, opki.Client("front-proxy-client", nil))
+	make(AggregationCA, MetropolisAuthProxyClient, opki.Client("metropolis-auth-proxy-client", nil))
 
 	return &pki
 }