diff --git a/overrides/values-imported-clusters.yaml b/overrides/values-imported-clusters.yaml
new file mode 100644
index 000000000..ac0987793
--- /dev/null
+++ b/overrides/values-imported-clusters.yaml
@@ -0,0 +1,15 @@
+# Auto-import existing (BYOC) clusters into ACM via the ACM chart.
+# Requires matching kubeconfig secrets in values-secret (vaultPrefixes: hub;
+# name must end with _cluster_kubeconfig — see values-secret.yaml.template).
+# Cluster name is secretName with that suffix removed.
+# clusterGroup must match a managedClusterGroups Placement label
+# (e.g. group-one in variants/hub/values-hub.yaml) so policies attach.
+#
+# This file is included by the ACM application via extraValueFiles.
+# To enable its usage, uncomment the following lines.
+# acm:
+#   importedClusters:
+#     - secretName: mcg-primary_cluster_kubeconfig
+#       clusterGroup: group-one
+    # - secretName: mcg-secondary_cluster_kubeconfig
+    #   clusterGroup: group-one
diff --git a/values-secret.yaml.template b/values-secret.yaml.template
index c068200f3..26aa9ba6a 100644
--- a/values-secret.yaml.template
+++ b/values-secret.yaml.template
@@ -38,3 +38,19 @@ secrets:
   #  fields:
   #  - name: content
   #    path: ~/.pullsecret.json
+
+  # Bring-your-own clusters: load kubeconfigs into Vault on the hub, then list
+  # them under acm.importedClusters in overrides/values-imported-clusters.yaml
+  # (wired to the ACM app via extraValueFiles in variants/hub/values-hub.yaml).
+  # Secret names MUST end with _cluster_kubeconfig; the ManagedCluster name is the
+  # remainder (e.g. mcg-primary_cluster_kubeconfig -> mcg-primary).
+  # The clusterGroup label must match an existing managedClusterGroups Placement
+  # (MCG already defines group-one).
+  #- name: mcg-primary_cluster_kubeconfig
+  #  fields:
+  #  - name: kubeconfig
+  #    path: /path/to/primary.kubeconfig
+  #- name: mcg-secondary_cluster_kubeconfig
+  #  fields:
+  #  - name: kubeconfig
+  #    path: /path/to/secondary.kubeconfig
diff --git a/variants/hub/values-hub.yaml b/variants/hub/values-hub.yaml
index 9b29943ab..4fc95a304 100644
--- a/variants/hub/values-hub.yaml
+++ b/variants/hub/values-hub.yaml
@@ -52,6 +52,18 @@ clusterGroup:
       argoProject: hub
       chart: acm
       chartVersion: 0.2.*
+      # BYOC importedClusters list lives here (not in values-hub body)
+      extraValueFiles:
+        - '/overrides/values-imported-clusters.yaml'
+      # ACM mutates ManagedCluster labels/spec after import (cloud/vendor discovery,
+      # addon feature labels, clusterset, managedClusterClientConfigs). Ignore those
+      # so the ACM app stays Synced while still owning clusterGroup via the chart.
+      ignoreDifferences:
+        - group: cluster.open-cluster-management.io
+          kind: ManagedCluster
+          jqPathExpressions:
+            - .metadata.labels | with_entries(select(.key != "clusterGroup"))
+            - .spec.managedClusterClientConfigs
     vault:
       name: vault
       namespace: vault
@@ -123,6 +135,7 @@ clusterGroup:
           #    clusters:
           #    - Two
           #    - Three
+
 #  To have apps in multiple flavors, use namespaces and use helm overrides as appropriate
 #
 #    pipelines: