diff --git a/internal/controller/broker_router.go b/internal/controller/broker_router.go
index d4f36b3a8..07d4ba77c 100644
--- a/internal/controller/broker_router.go
+++ b/internal/controller/broker_router.go
@@ -400,6 +400,7 @@ func (r *MCPGatewayExtensionReconciler) reconcileBrokerRouter(ctx context.Contex
 		existingContainer.ReadinessProbe = desiredContainer.ReadinessProbe
 		existingDeployment.Spec.Template.Spec.Containers[0] = existingContainer
 		existingDeployment.Spec.Template.Spec.Volumes = deployment.Spec.Template.Spec.Volumes
+		existingDeployment.Spec.Template.Spec.AutomountServiceAccountToken = deployment.Spec.Template.Spec.AutomountServiceAccountToken
 		if err := r.Update(ctx, existingDeployment); err != nil {
 			return false, fmt.Errorf("failed to update deployment: %w", err)
 		}
@@ -507,6 +508,10 @@ func deploymentNeedsUpdate(desired, existing *appsv1.Deployment) (bool, string)
 	if desiredContainer.Image != existingContainer.Image {
 		return true, fmt.Sprintf("image changed: %q -> %q", existingContainer.Image, desiredContainer.Image)
 	}
+	if !equality.Semantic.DeepEqual(desired.Spec.Template.Spec.AutomountServiceAccountToken, existing.Spec.Template.Spec.AutomountServiceAccountToken) {
+		return true, fmt.Sprintf("automountServiceAccountToken changed: %v -> %v",
+			existing.Spec.Template.Spec.AutomountServiceAccountToken, desired.Spec.Template.Spec.AutomountServiceAccountToken)
+	}
 	// only compare flags the controller manages; user-added flags are preserved
 	desiredCmd := filterManagedFlags(desiredContainer.Command)
 	existingCmd := filterManagedFlags(existingContainer.Command)