diff --git a/migration-tool/src/test/java/com/datastax/oss/kaap/migrationtool/PulsarClusterResourceGeneratorTest.java b/migration-tool/src/test/java/com/datastax/oss/kaap/migrationtool/PulsarClusterResourceGeneratorTest.java
index f4649a21..2eec8bb9 100644
--- a/migration-tool/src/test/java/com/datastax/oss/kaap/migrationtool/PulsarClusterResourceGeneratorTest.java
+++ b/migration-tool/src/test/java/com/datastax/oss/kaap/migrationtool/PulsarClusterResourceGeneratorTest.java
@@ -74,7 +74,7 @@ public void testNoFunctions() throws Exception {
         final DiffCollectorOutputWriter diff = generate(client, tmpDir);
         final File outputDir = new File(tmpDir.toFile(), CONTEXT);
         final PulsarCluster pulsar = getPulsarClusterFromOutputdir(outputDir);
-        assertDiff(diff, 122);
+        assertDiff(diff, 123);
         Assert.assertEquals(pulsar.getSpec().getFunctionsWorker().getReplicas(), 0);
     }
 
@@ -91,7 +91,7 @@ public void testNoBastion() throws Exception {
         final DiffCollectorOutputWriter diff = generate(client, tmpDir);
         final File outputDir = new File(tmpDir.toFile(), CONTEXT);
         final PulsarCluster pulsar = getPulsarClusterFromOutputdir(outputDir);
-        assertDiff(diff, 151);
+        assertDiff(diff, 152);
         Assert.assertEquals(pulsar.getSpec().getBastion().getReplicas(), 0);
     }
 
@@ -707,8 +707,6 @@ private void assertValue(File tmpDir) {
                                 value: pulsar://pulsar-cluster-broker:6650
                               - name: PulsarPublicKey
                                 value: /pulsar/token-public-key/pulsar-public.key
-                              - name: PulsarPrivateKey
-                                value: /pulsar/token-private-key/pulsar-private.key
                               - name: CertFile
                                 value: /pulsar/certs/tls.crt
                               - name: KeyFile
@@ -750,9 +748,6 @@ private void assertValue(File tmpDir) {
                               - mountPath: /pulsar/certs
                                 name: certs
                                 readOnly: true
-                              - mountPath: /pulsar/token-private-key
-                                name: token-private-key
-                                readOnly: true
                               - mountPath: /pulsar/token-public-key
                                 name: token-public-key
                                 readOnly: true
diff --git a/migration-tool/src/test/resources/pulsar-helm-chart/base-release/deployment-pulsar-cluster-proxy.yaml b/migration-tool/src/test/resources/pulsar-helm-chart/base-release/deployment-pulsar-cluster-proxy.yaml
index e34132ff..47078f49 100644
--- a/migration-tool/src/test/resources/pulsar-helm-chart/base-release/deployment-pulsar-cluster-proxy.yaml
+++ b/migration-tool/src/test/resources/pulsar-helm-chart/base-release/deployment-pulsar-cluster-proxy.yaml
@@ -207,8 +207,6 @@ spec:
           value: pulsar://pulsar-cluster-broker:6650
         - name: PulsarPublicKey
           value: /pulsar/token-public-key/pulsar-public.key
-        - name: PulsarPrivateKey
-          value: /pulsar/token-private-key/pulsar-private.key
         - name: CertFile
           value: /pulsar/certs/tls.crt
         - name: KeyFile
diff --git a/operator/src/main/java/com/datastax/oss/kaap/controllers/proxy/ProxyResourcesFactory.java b/operator/src/main/java/com/datastax/oss/kaap/controllers/proxy/ProxyResourcesFactory.java
index 8211c71c..d9f6f72b 100644
--- a/operator/src/main/java/com/datastax/oss/kaap/controllers/proxy/ProxyResourcesFactory.java
+++ b/operator/src/main/java/com/datastax/oss/kaap/controllers/proxy/ProxyResourcesFactory.java
@@ -400,7 +400,6 @@ public void patchDeployment() {
         }
         if (isAuthTokenEnabled()) {
             addSecretTokenVolume(volumeMounts, volumes, "public-key");
-            addSecretTokenVolume(volumeMounts, volumes, "private-key");
             addSecretTokenVolume(volumeMounts, volumes, "proxy");
             addSecretTokenVolume(volumeMounts, volumes, "websocket");
             addSecretTokenVolume(volumeMounts, volumes, "superuser");