diff --git a/operator/api/vectorized/v1alpha1/console_enterprise_types.go b/operator/api/vectorized/v1alpha1/console_enterprise_types.go
index 61db6b720..6f73141a6 100644
--- a/operator/api/vectorized/v1alpha1/console_enterprise_types.go
+++ b/operator/api/vectorized/v1alpha1/console_enterprise_types.go
@@ -179,6 +179,8 @@ type SecretStore struct {
 	GCPSecretManager *SecretManagerGCP        `json:"gcpSecretManager,omitempty"`
 	AWSSecretManager *SecretManagerAWS        `json:"awsSecretManager,omitempty"`
 	KafkaConnect     *SecretStoreKafkaConnect `json:"kafkaConnect,omitempty"`
+	// Scopes is a list of supported secret scopes
+	Scopes []string `json:"scopes,omitempty"`
 }
 
 // SecretManagerGCP is the configuration object for using Google Cloud's secret manager.
diff --git a/operator/api/vectorized/v1alpha1/zz_generated.deepcopy.go b/operator/api/vectorized/v1alpha1/zz_generated.deepcopy.go
index 421653d75..3b710fe34 100644
--- a/operator/api/vectorized/v1alpha1/zz_generated.deepcopy.go
+++ b/operator/api/vectorized/v1alpha1/zz_generated.deepcopy.go
@@ -1562,6 +1562,11 @@ func (in *SecretStore) DeepCopyInto(out *SecretStore) {
 		*out = new(SecretStoreKafkaConnect)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Scopes != nil {
+		in, out := &in.Scopes, &out.Scopes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretStore.
diff --git a/operator/config/crd/bases/redpanda.vectorized.io_consoles.yaml b/operator/config/crd/bases/redpanda.vectorized.io_consoles.yaml
index a37203457..04044a565 100644
--- a/operator/config/crd/bases/redpanda.vectorized.io_consoles.yaml
+++ b/operator/config/crd/bases/redpanda.vectorized.io_consoles.yaml
@@ -896,6 +896,11 @@ spec:
                     - clusters
                     - enabled
                     type: object
+                  scopes:
+                    description: Scopes is a list of supported secret scopes
+                    items:
+                      type: string
+                    type: array
                   secretNamePrefix:
                     description: |-
                       SecretNamePrefix is the prefix that shall be used for each secret name
diff --git a/operator/pkg/console/configmap.go b/operator/pkg/console/configmap.go
index d9ecd91a3..ed2935837 100644
--- a/operator/pkg/console/configmap.go
+++ b/operator/pkg/console/configmap.go
@@ -432,12 +432,19 @@ func (cm *ConfigMap) genSecretStore() EnterpriseSecretStore {
 			})
 		}
 	}
+	s := EnterpriseSecretStoreScopes{}
+	if ss.Scopes != nil {
+		s = EnterpriseSecretStoreScopes{
+			Scopes: ss.Scopes,
+		}
+	}
 	return EnterpriseSecretStore{
 		Enabled:          ss.Enabled,
 		SecretNamePrefix: ss.SecretNamePrefix,
 		GCPSecretManager: smGCP,
 		AWSSecretManager: smAWS,
 		KafkaConnect:     kc,
+		Scopes:           s,
 	}
 }
 
diff --git a/operator/pkg/console/console.go b/operator/pkg/console/console.go
index c4d3c9f6e..dc6177422 100644
--- a/operator/pkg/console/console.go
+++ b/operator/pkg/console/console.go
@@ -165,6 +165,7 @@ type EnterpriseSecretStore struct {
 	GCPSecretManager EnterpriseSecretManagerGCP        `json:"gcpSecretManager" yaml:"gcpSecretManager"`
 	AWSSecretManager EnterpriseSecretManagerAWS        `json:"awsSecretManager" yaml:"awsSecretManager"`
 	KafkaConnect     EnterpriseSecretStoreKafkaConnect `json:"kafkaConnect" yaml:"kafkaConnect"`
+	Scopes           EnterpriseSecretStoreScopes       `json:"scopes" yaml:"scopes"`
 }
 
 type EnterpriseSecretManagerGCP struct {
@@ -186,6 +187,10 @@ type EnterpriseSecretStoreKafkaConnect struct {
 	Clusters []EnterpriseSecretStoreKafkaConnectCluster `json:"clusters" yaml:"clusters"`
 }
 
+type EnterpriseSecretStoreScopes struct {
+	Scopes []string `json:"scopes" yaml:"scopes"`
+}
+
 type EnterpriseSecretStoreKafkaConnectCluster struct {
 	Name                   string `json:"name" yaml:"name"`
 	SecretNamePrefixAppend string `json:"secretNamePrefixAppend" yaml:"secretNamePrefixAppend"`