diff --git a/clusters/k3s-dgx/nim-service/qwen.yaml b/clusters/k3s-dgx/nim-service/qwen.yaml
index a78fcbf..6f5c863 100644
--- a/clusters/k3s-dgx/nim-service/qwen.yaml
+++ b/clusters/k3s-dgx/nim-service/qwen.yaml
@@ -88,3 +88,23 @@ spec:
       timeouts:
         request: 600s
         backendRequest: 600s
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: llm-bearer-auth
+  namespace: nim-service
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: llm-route
+
+  apiKeyAuth:
+    credentialRefs:
+    - group: ""
+      kind: Secret
+      name: mcp-bearer-token
+    extractFrom:
+    - headers:
+      - authorization