diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 16ec245..6f4f9ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,6 +55,9 @@ jobs:
       - name: 'Autoscaler unit configuration'
         run: bash test/autoscaler-unit.sh
 
+      - name: 'Invite users feature flag'
+        run: bash test/invite-users.sh
+
       - name: 'Install kubeconform'
         run: |
           curl -sSL -o /tmp/kubeconform.tar.gz \
diff --git a/README.md b/README.md
index 22c890a..7d770be 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,7 @@ production-ready set of values except for the `secrets` portion.
 | `services.icc.features.risk_service_dump.enable` | Enable long-term storage for the risk service | false | No |
 | `services.icc.features.ffc.enable` | Fussion, Fission & Cascade | false | No |
 | `services.icc.features.scaler_trends_learning.enable` | Enable scaler trend learning | false | No |
+| `services.icc.features.invite_users.enable` | Allow super-admins to invite users by email from Settings > Users | false | No |
 | `services.icc.features.skew_protection.enable` | Enable version skew protection via Gateway API (opt-in, see [Requirements](#gateway-api-skew-protection)) | false | No |
 | `services.icc.features.skew_protection.auto_cleanup` | Delete expired Deployment and Service resources | false | No |
 | `services.icc.features.skew_protection.http_grace_period_ms` | Min time to keep an HTTP version draining | 1800000 | No |
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index a084187..209137a 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: helm
-version: 4.3.0
+version: 4.4.0
 kubeVersion: ">= 1.30.0-0"
 description: Platformatic microservices
 type: application
diff --git a/chart/templates/deployment/_icc.yaml b/chart/templates/deployment/_icc.yaml
index 1fb94be..f9dd2f3 100644
--- a/chart/templates/deployment/_icc.yaml
+++ b/chart/templates/deployment/_icc.yaml
@@ -109,6 +109,8 @@ spec:
               value: "{{ .features.scaler_trends_learning.enable | default false | toString }}"
             - name: PLT_FEATURE_SKEW_PROTECTION
               value: "{{ .features.skew_protection.enable | default false | toString }}"
+            - name: PLT_FEATURE_INVITE_USERS
+              value: '{{ dig "features" "invite_users" "enable" false . | toString }}'
             - name: PLT_SKEW_AUTO_CLEANUP
               value: "{{ dig "features" "skew_protection" "auto_cleanup" false . | toString }}"
             {{- with dig "features" "skew_protection" "http_grace_period_ms" nil . }}
diff --git a/chart/values.yaml b/chart/values.yaml
index c0e11b8..53a31e7 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -81,6 +81,8 @@ services:
         enable: false
       scaler_trends_learning:
         enable: false
+      invite_users:
+        enable: false                        # Show "Invite users" in Settings > Users
       deployer:
         enable: false                        # ICC deployer creates workloads via the deploy API (Deployments/Services/pull Secrets). Off = observe-only, least privilege
       skew_protection:
diff --git a/test/invite-users.sh b/test/invite-users.sh
new file mode 100755
index 0000000..df121a0
--- /dev/null
+++ b/test/invite-users.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+CHART_DIR="$ROOT_DIR/chart"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+invite_users() {
+  awk '
+    $1 == "-" && $2 == "name:" && $3 == "PLT_FEATURE_INVITE_USERS" { found = 1; next }
+    found && $1 == "value:" { gsub(/["\047]/, "", $2); print $2; exit }
+  '
+}
+
+required_values=(
+  --set-string services.icc.database_url=postgres://user:pass@db:5432
+  --set-string services.icc.valkey.apps_url=redis://valkey:6379/0
+  --set-string services.icc.valkey.icc_url=redis://valkey:6379/1
+  --set-string services.icc.prometheus.url=http://prometheus:9090
+)
+
+default_value=$(helm template invite-users "$CHART_DIR" \
+  --kube-version 1.30.0 \
+  "${required_values[@]}" | invite_users)
+
+[[ "$default_value" == 'false' ]] || \
+  fail "default invite users flag is $default_value, expected false"
+
+enabled_value=$(helm template invite-users "$CHART_DIR" \
+  --kube-version 1.30.0 \
+  "${required_values[@]}" \
+  --set services.icc.features.invite_users.enable=true | invite_users)
+
+[[ "$enabled_value" == 'true' ]] || \
+  fail "enabled invite users flag is $enabled_value, expected true"
+
+# Values files written before this option existed have no invite_users key.
+missing_value=$(helm template invite-users "$CHART_DIR" \
+  --kube-version 1.30.0 \
+  "${required_values[@]}" \
+  --set services.icc.features.invite_users=null | invite_users)
+
+[[ "$missing_value" == 'false' ]] || \
+  fail "invite users flag without the key is $missing_value, expected false"
+
+echo 'Invite users tests passed'