diff --git a/bootstrap/argocd-install/argocd-api-user.yaml b/bootstrap/argocd-install/argocd-api-user.yaml
new file mode 100644
index 0000000..1f783a8
--- /dev/null
+++ b/bootstrap/argocd-install/argocd-api-user.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  accounts.api: apiKey
+  accounts.api.enabled: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, api, role:readonly
diff --git a/bootstrap/argocd-install/kustomization.yaml b/bootstrap/argocd-install/kustomization.yaml
index 0d2d7ee..22548a0 100644
--- a/bootstrap/argocd-install/kustomization.yaml
+++ b/bootstrap/argocd-install/kustomization.yaml
@@ -9,3 +9,4 @@ resources:
 
 patches:
   - path: server-insecure-patch.yaml
+  - path: argocd-api-user.yaml