diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8c60c75..be41eaf3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Added
 
 - More CRD documentation ([#354]).
+- Helm: support labels in values.yaml ([#374]).
 
 ### Changed
 
@@ -27,6 +28,7 @@
 [#354]: https://github.com/stackabletech/airflow-operator/pull/354
 [#366]: https://github.com/stackabletech/airflow-operator/pull/366
 [#372]: https://github.com/stackabletech/airflow-operator/pull/372
+[#374]: https://github.com/stackabletech/airflow-operator/pull/374
 
 ## [23.11.0] - 2023-11-24
 
diff --git a/deploy/helm/airflow-operator/templates/_helpers.tpl b/deploy/helm/airflow-operator/templates/_helpers.tpl
index a2258b27..7ba6bb6c 100644
--- a/deploy/helm/airflow-operator/templates/_helpers.tpl
+++ b/deploy/helm/airflow-operator/templates/_helpers.tpl
@@ -55,8 +55,10 @@ Selector labels
 {{- define "operator.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "operator.appname" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
+{{- with .Values.labels }}
+{{ toYaml . }}
+{{- end }}
 {{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}
diff --git a/deploy/helm/airflow-operator/templates/deployment.yaml b/deploy/helm/airflow-operator/templates/deployment.yaml
index f60334cd..69dfa6f6 100644
--- a/deploy/helm/airflow-operator/templates/deployment.yaml
+++ b/deploy/helm/airflow-operator/templates/deployment.yaml
@@ -20,10 +20,11 @@ spec:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+
       labels:
         {{- include "operator.selectorLabels" . | nindent 8 }}
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with .Values.image.pullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
diff --git a/deploy/helm/airflow-operator/templates/roles.yaml b/deploy/helm/airflow-operator/templates/roles.yaml
index 7ac0d78a..800426dc 100644
--- a/deploy/helm/airflow-operator/templates/roles.yaml
+++ b/deploy/helm/airflow-operator/templates/roles.yaml
@@ -3,6 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ include "operator.fullname" . }}-clusterrole
+  labels:
+  {{- include "operator.labels" . | nindent 4 }}
 rules:
   - apiGroups:
       - ""
@@ -126,6 +128,8 @@ apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:
   name: airflow-scc
+  labels:
+  {{- include "operator.labels" . | nindent 4 }}
   annotations:
     kubernetes.io/description: |-
       This resource is derived from hostmount-anyuid. It provides all the features of the
@@ -171,6 +175,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ include "operator.name" . }}-clusterrole
+  labels:
+  {{- include "operator.labels" . | nindent 4 }}
 rules:
   - apiGroups:
       - ""
diff --git a/deploy/helm/airflow-operator/values.yaml b/deploy/helm/airflow-operator/values.yaml
index c1de0d42..f2963fb6 100644
--- a/deploy/helm/airflow-operator/values.yaml
+++ b/deploy/helm/airflow-operator/values.yaml
@@ -3,8 +3,8 @@
 image:
   repository: docker.stackable.tech/stackable/airflow-operator
   pullPolicy: IfNotPresent
+  pullSecrets: []
 
-imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
@@ -17,6 +17,9 @@ serviceAccount:
   # If not set and create is true, a name is generated using the fullname template
   name: ""
 
+# Provide additional labels which get attached to all deployed resources
+labels: {}
+
 podAnnotations: {}
 
 podSecurityContext: {}