diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92323178a..e83807d68 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 ## [Unreleased]
 
+### Added
+
+- Add option to disable k8s client cache.
+
 ## [6.9.0] - 2023-11-10
 
 ### Changed
diff --git a/flag/service/kubernetes/kubernetes.go b/flag/service/kubernetes/kubernetes.go
new file mode 100644
index 000000000..601a7cb7c
--- /dev/null
+++ b/flag/service/kubernetes/kubernetes.go
@@ -0,0 +1,18 @@
+package kubernetes
+
+import (
+	"github.com/giantswarm/operatorkit/v8/pkg/flag/service/kubernetes/tls"
+	"github.com/giantswarm/operatorkit/v8/pkg/flag/service/kubernetes/watch"
+)
+
+// Kubernetes is a data structure to hold Kubernetes specific command line
+// configuration flags.
+type Kubernetes struct {
+	Address            string
+	DisableClientCache string
+	InCluster          string
+	KubeConfig         string
+	KubeConfigPath     string
+	TLS                tls.TLS
+	Watch              watch.Watch
+}
diff --git a/flag/service/service.go b/flag/service/service.go
index 3a74e834d..6e4fa6d2c 100644
--- a/flag/service/service.go
+++ b/flag/service/service.go
@@ -1,13 +1,12 @@
 package service
 
 import (
-	"github.com/giantswarm/operatorkit/v8/pkg/flag/service/kubernetes"
-
 	"github.com/giantswarm/app-operator/v6/flag/service/app"
 	"github.com/giantswarm/app-operator/v6/flag/service/appcatalog"
 	"github.com/giantswarm/app-operator/v6/flag/service/chart"
 	"github.com/giantswarm/app-operator/v6/flag/service/helm"
 	"github.com/giantswarm/app-operator/v6/flag/service/image"
+	"github.com/giantswarm/app-operator/v6/flag/service/kubernetes"
 	"github.com/giantswarm/app-operator/v6/flag/service/operatorkit"
 	"github.com/giantswarm/app-operator/v6/flag/service/provider"
 )
diff --git a/helm/app-operator/templates/configmap.yaml b/helm/app-operator/templates/configmap.yaml
index 0dbf975c1..35e4c46ec 100644
--- a/helm/app-operator/templates/configmap.yaml
+++ b/helm/app-operator/templates/configmap.yaml
@@ -26,6 +26,7 @@ data:
         registry: '{{ .Values.registry.domain }}'
       kubernetes:
         incluster: true
+        disableClientCache: {{ $.Values.kubernetes.disableClientCache }}
       operatorkit:
         resyncPeriod: '{{ .Values.operatorkit.resyncPeriod }}'
       provider:
diff --git a/helm/app-operator/values.schema.json b/helm/app-operator/values.schema.json
index 746e99f7a..a6e73af16 100644
--- a/helm/app-operator/values.schema.json
+++ b/helm/app-operator/values.schema.json
@@ -113,6 +113,14 @@
         }
       }
     },
+    "kubernetes": {
+      "type": "object",
+      "properties": {
+        "disableClientCache": {
+          "type": "boolean"
+        }
+      }
+    },
     "name": {
       "type": "string"
     },
diff --git a/helm/app-operator/values.yaml b/helm/app-operator/values.yaml
index fcff27818..d820feb47 100644
--- a/helm/app-operator/values.yaml
+++ b/helm/app-operator/values.yaml
@@ -19,6 +19,9 @@ helm:
 provider:
   kind: ""
 
+kubernetes:
+  disableClientCache: false
+
 userID: 1000
 groupID: 1000
 
diff --git a/main.go b/main.go
index dbf645354..fe39ecaa3 100644
--- a/main.go
+++ b/main.go
@@ -155,6 +155,7 @@ func mainWithError() (err error) {
 	daemonCommand.PersistentFlags().String(f.Service.Helm.HTTP.ClientTimeout, "5s", "HTTP timeout for pulling chart tarballs.")
 	daemonCommand.PersistentFlags().String(f.Service.Image.Registry, "quay.io", "The container registry for pulling Tiller images.")
 	daemonCommand.PersistentFlags().String(f.Service.Kubernetes.Address, "", "Address used to connect to Kubernetes. When empty in-cluster config is created.")
+	daemonCommand.PersistentFlags().Bool(f.Service.Kubernetes.DisableClientCache, false, "Disable Kubernetes client cache.")
 	daemonCommand.PersistentFlags().Bool(f.Service.Kubernetes.InCluster, true, "Whether to use the in-cluster config to authenticate with Kubernetes.")
 	daemonCommand.PersistentFlags().String(f.Service.Kubernetes.KubeConfig, "", "KubeConfig used to connect to Kubernetes. When empty other settings are used.")
 	daemonCommand.PersistentFlags().String(f.Service.Kubernetes.TLS.CAFile, "", "Certificate authority file path to use to authenticate with Kubernetes.")
diff --git a/service/internal/clientcache/cache.go b/service/internal/clientcache/cache.go
index c5534b8f4..523d8ed86 100644
--- a/service/internal/clientcache/cache.go
+++ b/service/internal/clientcache/cache.go
@@ -30,6 +30,7 @@ type Config struct {
 
 	// Settings.
 	HTTPClientTimeout time.Duration
+	DisableCache      bool
 }
 
 type Resource struct {
@@ -41,6 +42,7 @@ type Resource struct {
 
 	// Settings.
 	httpClientTimeout time.Duration
+	disableCache      bool
 }
 
 type clients struct {
@@ -73,6 +75,7 @@ func New(config Config) (*Resource, error) {
 
 		// Settings
 		httpClientTimeout: config.HTTPClientTimeout,
+		disableCache:      config.DisableCache,
 	}
 
 	return r, nil
@@ -81,13 +84,15 @@ func New(config Config) (*Resource, error) {
 func (r *Resource) GetClients(ctx context.Context, kubeConfig *v1alpha1.AppSpecKubeConfig) (*clients, error) {
 	k := fmt.Sprintf("%s/%s", kubeConfig.Secret.Namespace, kubeConfig.Secret.Name)
 
-	if v, ok := r.cache.Get(k); ok {
-		c, ok := v.(clients)
-		if !ok {
-			return nil, microerror.Maskf(wrongTypeError, "expected '%T', got '%T'", clients{}, v)
-		}
+	if !r.disableCache {
+		if v, ok := r.cache.Get(k); ok {
+			c, ok := v.(clients)
+			if !ok {
+				return nil, microerror.Maskf(wrongTypeError, "expected '%T', got '%T'", clients{}, v)
+			}
 
-		return &c, nil
+			return &c, nil
+		}
 	}
 
 	var c clients
diff --git a/service/service.go b/service/service.go
index 8144418e8..d6b6b6a42 100644
--- a/service/service.go
+++ b/service/service.go
@@ -94,6 +94,7 @@ func New(config Config) (*Service, error) {
 			Logger:    config.Logger,
 
 			HTTPClientTimeout: config.Viper.GetDuration(config.Flag.Service.Helm.HTTP.ClientTimeout),
+			DisableCache:      config.Viper.GetBool(config.Flag.Service.Kubernetes.DisableClientCache),
 		}
 
 		clientCache, err = clientcache.New(c)