diff --git a/api/v1alpha1/setupkey_types.go b/api/v1alpha1/setupkey_types.go
index 17e9f3c..a591243 100644
--- a/api/v1alpha1/setupkey_types.go
+++ b/api/v1alpha1/setupkey_types.go
@@ -16,6 +16,11 @@ type SetupKeySpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ephemeral is immutable"
 	Ephemeral bool `json:"ephemeral"`
 
+	// AllowExtraDnsLabels decides if peers added with the key can have extra DNS labels.
+	// +kubebuilder:default=false
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="allowExtraDnsLabels is immutable"
+	AllowExtraDnsLabels bool `json:"allowExtraDnsLabels"`
+
 	// Duration sets how long the setup key is valid for.
 	// +optional
 	// +kubebuilder:validation:Type=string
diff --git a/charts/netbird-operator/crds/netbird.io_setupkeys.yaml b/charts/netbird-operator/crds/netbird.io_setupkeys.yaml
index 0b1cad4..0208852 100644
--- a/charts/netbird-operator/crds/netbird.io_setupkeys.yaml
+++ b/charts/netbird-operator/crds/netbird.io_setupkeys.yaml
@@ -46,6 +46,14 @@ spec:
           spec:
             description: SetupKeySpec defines the desired state of SetupKey.
             properties:
+              allowExtraDnsLabels:
+                default: false
+                description: AllowExtraDnsLabels decides if peers added with the key
+                  can have extra DNS labels.
+                type: boolean
+                x-kubernetes-validations:
+                - message: allowExtraDnsLabels is immutable
+                  rule: self == oldSelf
               autoGroups:
                 description: AutoGroups are groups that will be automatically assigned
                   to peers using setup key.
@@ -96,6 +104,7 @@ spec:
                 minLength: 1
                 type: string
             required:
+            - allowExtraDnsLabels
             - ephemeral
             - name
             type: object
diff --git a/config/crd/bases/netbird.io_setupkeys.yaml b/config/crd/bases/netbird.io_setupkeys.yaml
index 0b1cad4..0208852 100644
--- a/config/crd/bases/netbird.io_setupkeys.yaml
+++ b/config/crd/bases/netbird.io_setupkeys.yaml
@@ -46,6 +46,14 @@ spec:
           spec:
             description: SetupKeySpec defines the desired state of SetupKey.
             properties:
+              allowExtraDnsLabels:
+                default: false
+                description: AllowExtraDnsLabels decides if peers added with the key
+                  can have extra DNS labels.
+                type: boolean
+                x-kubernetes-validations:
+                - message: allowExtraDnsLabels is immutable
+                  rule: self == oldSelf
               autoGroups:
                 description: AutoGroups are groups that will be automatically assigned
                   to peers using setup key.
@@ -96,6 +104,7 @@ spec:
                 minLength: 1
                 type: string
             required:
+            - allowExtraDnsLabels
             - ephemeral
             - name
             type: object
diff --git a/docs/api-reference.md b/docs/api-reference.md
index b7a361c..01a4e2a 100644
--- a/docs/api-reference.md
+++ b/docs/api-reference.md
@@ -315,6 +315,7 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `name` _string_ | Name of the setup key. |  | MinLength: 1 <br /> |
 | `ephemeral` _boolean_ | Ephemeral decides if peers added with the key are ephemeral or not. |  |  |
+| `allowExtraDnsLabels` _boolean_ | AllowExtraDnsLabels decides if peers added with the key can have extra DNS labels. | false |  |
 | `duration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta)_ | Duration sets how long the setup key is valid for. |  | Pattern: `^([0-9]+(\.[0-9]+)?(m\|h))+$` <br />Type: string <br />Optional: \{\} <br /> |
 | `autoGroups` _[GroupReference](#groupreference) array_ | AutoGroups are groups that will be automatically assigned to peers using setup key. |  | Optional: \{\} <br /> |
 
diff --git a/internal/controller/setupkey_controller.go b/internal/controller/setupkey_controller.go
index 92402a2..bc5a0aa 100644
--- a/internal/controller/setupkey_controller.go
+++ b/internal/controller/setupkey_controller.go
@@ -125,7 +125,7 @@ func (r *SetupKeyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 		expiresIn = int(setupKey.Spec.Duration.Seconds())
 	}
 	setupKeyReq := api.PostApiSetupKeysJSONRequestBody{
-		AllowExtraDnsLabels: new(false),
+		AllowExtraDnsLabels: &setupKey.Spec.AllowExtraDnsLabels,
 		AutoGroups:          autoGroupIDs,
 		Ephemeral:           new(setupKey.Spec.Ephemeral),
 		ExpiresIn:           expiresIn,
diff --git a/pkg/applyconfigurations/api/v1alpha1/setupkeyspec.go b/pkg/applyconfigurations/api/v1alpha1/setupkeyspec.go
index 2c02f6b..00d53b9 100644
--- a/pkg/applyconfigurations/api/v1alpha1/setupkeyspec.go
+++ b/pkg/applyconfigurations/api/v1alpha1/setupkeyspec.go
@@ -17,6 +17,8 @@ type SetupKeySpecApplyConfiguration struct {
 	Name *string `json:"name,omitempty"`
 	// Ephemeral decides if peers added with the key are ephemeral or not.
 	Ephemeral *bool `json:"ephemeral,omitempty"`
+	// AllowExtraDnsLabels decides if peers added with the key can have extra DNS labels.
+	AllowExtraDnsLabels *bool `json:"allowExtraDnsLabels,omitempty"`
 	// Duration sets how long the setup key is valid for.
 	Duration *v1.Duration `json:"duration,omitempty"`
 	// AutoGroups are groups that will be automatically assigned to peers using setup key.
@@ -45,6 +47,14 @@ func (b *SetupKeySpecApplyConfiguration) WithEphemeral(value bool) *SetupKeySpec
 	return b
 }
 
+// WithAllowExtraDnsLabels sets the AllowExtraDnsLabels field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AllowExtraDnsLabels field is set to the value of the last call.
+func (b *SetupKeySpecApplyConfiguration) WithAllowExtraDnsLabels(value bool) *SetupKeySpecApplyConfiguration {
+	b.AllowExtraDnsLabels = &value
+	return b
+}
+
 // WithDuration sets the Duration field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Duration field is set to the value of the last call.