diff --git a/charts/databend-query/Chart.yaml b/charts/databend-query/Chart.yaml
index a49c1a9..a4ee9b7 100644
--- a/charts/databend-query/Chart.yaml
+++ b/charts/databend-query/Chart.yaml
@@ -25,7 +25,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.11.2
+version: 0.11.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/databend-query/templates/configmap.yaml b/charts/databend-query/templates/configmap.yaml
index e70f092..6f8c33e 100644
--- a/charts/databend-query/templates/configmap.yaml
+++ b/charts/databend-query/templates/configmap.yaml
@@ -31,7 +31,11 @@ data:
         name = {{ .name | quote }}
         auth_type = {{ .authType | quote }}
         {{- if eq .authType "sha256_password"}}
+        {{- if $.Values.config.query.passwords.generateSha256FromPlaintext }}
+        auth_string = {{ sha256sum .password | quote }}
+        {{- else }}
         auth_string = {{ .authString | quote }}
+        {{- end }}
         {{- else if eq .authType "double_sha1_password"}}
         auth_string = {{ .authString | quote }}
         {{- end }}
diff --git a/charts/databend-query/values.yaml b/charts/databend-query/values.yaml
index 9035593..2c1e9a5 100644
--- a/charts/databend-query/values.yaml
+++ b/charts/databend-query/values.yaml
@@ -88,6 +88,9 @@ config:
       max_active_sessions: 256
       databend_enterprise_license: ""
 
+    passwords:
+      generateSha256FromPlaintext: false
+
     # NOTE: user `root` is already built-in, will be ignored if defined here
     users: []
       # - name: databend
@@ -95,6 +98,8 @@ config:
       #   # sha1sum: echo -n "password" | sha1sum | cut -d' ' -f1 | xxd -r -p | sha1sum
       #   authType: double_sha1_password
       #   authString: 3081f32caef285c232d066033c89a78d88a6d8a5  # databend
+      #   password: thisIsAnExamplePassword # If generateSha256FromPlaintext is enabled above, this value will be used instead of authString.
+    
     # NOTE: use it for on premise session parameters
     settings: {}