diff --git a/deploy/charts/burrito/templates/config.yaml b/deploy/charts/burrito/templates/config.yaml
index 5e21cad5..a7869371 100644
--- a/deploy/charts/burrito/templates/config.yaml
+++ b/deploy/charts/burrito/templates/config.yaml
@@ -22,10 +22,15 @@ Datastore Authorized Service Accounts
 {{- end }}
 {{- end }}
 {{- $controller := printf "%s/%s" .Release.Namespace "burrito-controllers" }}
-{{- $datastoreAuthorizedServiceAccounts = append $datastoreAuthorizedServiceAccounts $controller }}
+# check if the service account is already in the list, to prevent adding it multiple times if the config rerenders
+{{- if not (has $controller $config.datastore.serviceAccounts) }}
+  {{- $datastoreAuthorizedServiceAccounts = append $datastoreAuthorizedServiceAccounts $controller }}
+{{- end }}
 {{- $server := printf "%s/%s" .Release.Namespace "burrito-server" }}
-{{- $datastoreAuthorizedServiceAccounts = append $datastoreAuthorizedServiceAccounts $server }}
-{{- $_ := set $config.datastore "serviceAccounts" $datastoreAuthorizedServiceAccounts }}
+{{- if not (has $server $config.datastore.serviceAccounts) }}
+  {{- $datastoreAuthorizedServiceAccounts = append $datastoreAuthorizedServiceAccounts $server }}
+{{- end }}
+{{- $_ := set $config.datastore "serviceAccounts" (concat $datastoreAuthorizedServiceAccounts $config.datastore.serviceAccounts) }}
 
 {{/*
 TLS certificates
diff --git a/deploy/charts/burrito/values.yaml b/deploy/charts/burrito/values.yaml
index 680eb3b8..848dbdb7 100644
--- a/deploy/charts/burrito/values.yaml
+++ b/deploy/charts/burrito/values.yaml
@@ -58,7 +58,7 @@ config:
     # -- Provider cache custom configuration
     hermitcrab: {}
     datastore:
-      # -- Service account to use for datastore operations (e.g. reading/writing to storage)
+      # -- Service accounts that are allowed to access the datastore API in namespace/name format (not the service account used by the datastore pods, check datastore.serviceAccount.metadata for that)
       serviceAccounts: []
       storage:
         # -- Use in-memory storage for testing - not intended for production use, data will be lost on datastore restart
@@ -369,6 +369,7 @@ datastore:
     labels:
       app.kubernetes.io/component: datastore
       app.kubernetes.io/name: burrito-datastore
+  # -- Service account configuration for the Burrito datastore deployment. Use this to grant permission to the datastore to interact with external storage
   serviceAccount:
     metadata:
       annotations: {}