diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 231d696..e521308 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -59,11 +59,11 @@ jobs:
           for values_file in test/values-*.yaml; do
             name=$(basename "$values_file" .yaml | sed 's/values-//')
             echo "==> Validating config for $name..."
-            rm -f /tmp/pgdog.toml
-            ./test/generate-config.sh "$values_file" /tmp/pgdog.toml
+            ./test/generate-config.sh "$values_file" /tmp/pgdog.toml /tmp/users.toml
             docker run --rm \
               -v /tmp/pgdog.toml:/tmp/pgdog.toml:ro \
+              -v /tmp/users.toml:/tmp/users.toml:ro \
               "$PGDOG_IMAGE" \
-              /usr/local/bin/pgdog --config=/tmp/pgdog.toml configcheck
+              /usr/local/bin/pgdog --config=/tmp/pgdog.toml --users=/tmp/users.toml configcheck
           done
           echo "==> All configs valid!"
diff --git a/Chart.yaml b/Chart.yaml
index c31ed3a..ce74342 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -1,4 +1,4 @@
 apiVersion: v1
 name: pgdog
-version: v0.93
-appVersion: "v0.1.61"
+version: v0.94
+appVersion: "v0.1.63"
diff --git a/README.md b/README.md
index 0c1476c..26a306f 100644
--- a/README.md
+++ b/README.md
@@ -100,9 +100,6 @@ users:
     password: "hunter2" # See ExternalSecrets for secure storage
 ```
 
-Set `authType` on a user to override the general `authType` setting. It accepts
-the same values and renders as `auth_type` in `users.toml`.
-
 **⚠️ For production**: Use ExternalSecrets instead of plain text
 passwords (see ExternalSecrets section below).
 
diff --git a/templates/secrets.yaml b/templates/secrets.yaml
index 03d8ed1..e9ccb63 100644
--- a/templates/secrets.yaml
+++ b/templates/secrets.yaml
@@ -47,6 +47,9 @@ idle_timeout = {{ .idleTimeout }}
 {{- if .readOnly }}
 read_only = {{ .readOnly }}
 {{- end }}
+{{- if hasKey . "readWriteSplit" }}
+read_write_split = {{ .readWriteSplit | quote }}
+{{- end }}
 {{- if hasKey . "schemaAdmin" }}
 schema_admin = {{ .schemaAdmin }}
 {{- end }}
diff --git a/test/generate-config.sh b/test/generate-config.sh
index b3b8725..cf01bb6 100755
--- a/test/generate-config.sh
+++ b/test/generate-config.sh
@@ -5,14 +5,15 @@ TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CHART_DIR="$TEST_DIR/.."
 
 if [ -z "$1" ]; then
-  echo "Usage: $0 <values-file> [output-file]"
-  echo "Example: $0 values-full.yaml pgdog.toml"
+  echo "Usage: $0 <values-file> [output-file] [users-output-file]"
+  echo "Example: $0 values-full.yaml pgdog.toml users.toml"
   exit 1
 fi
 
 VALUES_FILE="$1"
 
-output=$(helm template pgdog "$CHART_DIR" -f "$VALUES_FILE" \
+rendered=$(helm template pgdog "$CHART_DIR" -f "$VALUES_FILE")
+output=$(echo "$rendered" \
   | yq -r 'select(.kind == "ConfigMap" and .metadata.name == "pgdog") | .data["pgdog.toml"]')
 
 if [ -z "$2" ]; then
@@ -20,3 +21,10 @@ if [ -z "$2" ]; then
 else
   echo "$output" > "$2"
 fi
+
+if [ -n "$3" ]; then
+  # An absent Secret (e.g. externally managed users) produces an empty users file.
+  echo "$rendered" \
+    | yq -r 'select(.kind == "Secret" and .metadata.name == "pgdog") | .data["users.toml"] // ""' \
+    | base64 -d > "$3"
+fi
diff --git a/test/values-control.yaml b/test/values-control.yaml
index e1236f0..ee26ed9 100644
--- a/test/values-control.yaml
+++ b/test/values-control.yaml
@@ -18,5 +18,6 @@ databases:
     port: 5432
 
 users:
-  - username: app_user
+  - name: app_user
+    database: primary
     password: secret123
diff --git a/test/values-full.yaml b/test/values-full.yaml
index adc8a73..e085874 100644
--- a/test/values-full.yaml
+++ b/test/values-full.yaml
@@ -93,10 +93,13 @@ databases:
     shard: 1
 
 users:
-  - username: app_user
+  - name: app_user
+    database: primary
     password: secret123
-    poolMode: transaction
-  - username: admin_user
+    poolerMode: transaction
+    readWriteSplit: exclude_primary
+  - name: admin_user
+    database: primary
     password: admin123
 
 shardedTables:
diff --git a/test/values-rewrite.yaml b/test/values-rewrite.yaml
index fde42ed..bb42a75 100644
--- a/test/values-rewrite.yaml
+++ b/test/values-rewrite.yaml
@@ -12,5 +12,6 @@ databases:
     port: 5432
 
 users:
-  - username: app_user
+  - name: app_user
+    database: primary
     password: secret123
diff --git a/values.yaml b/values.yaml
index 200ee51..fc7f8d9 100644
--- a/values.yaml
+++ b/values.yaml
@@ -253,6 +253,7 @@ databases: []
 # camelCase format.
 # Set identity on a user to match the identity in its client TLS certificate.
 # Set authType on a user to override the general authType setting.
+# Set readWriteSplit on a user to render read_write_split in users.toml (optional).
 # Set serverIamRegion to the AWS region for RDS IAM authentication
 # when serverAuth is rds_iam.
 # Set serverIamAssumeRole to an IAM role ARN to assume for RDS IAM authentication