diff --git a/charts/dgraph/README.md b/charts/dgraph/README.md
index d21724d5b..6cb55a7ad 100644
--- a/charts/dgraph/README.md
+++ b/charts/dgraph/README.md
@@ -44,6 +44,8 @@ No manual intervention is required. Also review the [additional breaking changes
 
 **Backup admin password now required**: When `alpha.acl.enabled` is true and backups are enabled, `backups.admin.password` must be explicitly set. Previously the chart would silently render an empty secret, which would cause backup failures at runtime. The chart now fails at install/upgrade time with a clear error message if the password is missing.
 
+**ACL and encryption flags now auto-activate**: Setting `alpha.acl.enabled: true` (or `alpha.encryption.enabled: true`) now synthesizes the matching `--acl` (or `--encryption`) superflag onto the Alpha command automatically; previously these flags had to be added by hand through `alpha.extraFlags`. If you already pass `--acl` or `--encryption` through `alpha.extraFlags`, remove it — the chart fails rendering rather than pass the flag twice. The chart points the flag at `/dgraph/acl/<alpha.acl.secretFile>` and `/dgraph/enc/<alpha.encryption.keyFile>`, which default to `hmac_secret_file` and `enc_key_file`; override those keys if your Secret stores the file under a different name.
+
 ### Installing the Chart
 
 To install the chart with the release name `my-release`:
@@ -183,9 +185,13 @@ The following table lists the configurable parameters of the `dgraph` chart and
 | `alpha.securityContext.runAsUser`        | User ID for the Alpha container                                       | `1001`                                              |
 | `alpha.tls.enabled`                      | Alpha service TLS enabled                                             | `false`                                             |
 | `alpha.tls.files`                        | Alpha service TLS key and certificate files stored as secrets         | `false`                                             |
-| `alpha.encryption.enabled`               | Alpha Encryption at Rest enabled                                      | `false`                                             |
+| `alpha.encryption.enabled`               | Alpha Encryption at Rest enabled (auto-adds `--encryption`)           | `false`                                             |
+| `alpha.encryption.keyFile`               | Filename/key of the encryption key within the mounted Secret          | `enc_key_file`                                      |
+| `alpha.encryption.existingSecret`        | Name of a pre-created Secret holding the encryption key (suppresses the chart's own) | `""`                                |
 | `alpha.encryption.file`                  | Alpha Encryption at Rest key file                                     | `nil`                                               |
-| `alpha.acl.enabled`                      | Alpha ACL enabled                                                     | `false`                                             |
+| `alpha.acl.enabled`                      | Alpha ACL enabled (auto-adds `--acl`)                                 | `false`                                             |
+| `alpha.acl.secretFile`                   | Filename/key of the HMAC secret within the mounted Secret             | `hmac_secret_file`                                  |
+| `alpha.acl.existingSecret`               | Name of a pre-created Secret holding the HMAC key (suppresses the chart's own) | `""`                                      |
 | `alpha.acl.file`                         | Alpha ACL secret file                                                 | `nil`                                               |
 | `alpha.persistence.enabled`              | Enable persistence for alpha using PVC                                | `true`                                              |
 | `alpha.persistence.storageClass`         | PVC Storage Class for alpha volume                                    | `nil`                                               |
diff --git a/charts/dgraph/templates/alpha/statefulset.yaml b/charts/dgraph/templates/alpha/statefulset.yaml
index 797f54e37..cd4301e50 100644
--- a/charts/dgraph/templates/alpha/statefulset.yaml
+++ b/charts/dgraph/templates/alpha/statefulset.yaml
@@ -26,6 +26,15 @@
 {{- $hasMinioKeys := include "dgraph.backups.keys.minio.enabled" . -}}
 {{- $backupsEnabled := or .Values.backups.full.enabled .Values.backups.incremental.enabled }}
 {{- $initContainerEnabled := or .Values.alpha.initContainers.init.enabled .Values.alpha.extraInitContainers }}
+{{- /* ACL and encryption-at-rest activate from `enabled` below by synthesizing the
+       matching superflag onto the alpha command. Fail rather than emit a duplicate
+       flag if the operator also hand-set it in extraFlags. */}}
+{{- if and .Values.alpha.acl.enabled (contains "--acl" (.Values.alpha.extraFlags | default "")) }}
+{{- fail "alpha.acl.enabled synthesizes the --acl superflag, but alpha.extraFlags already contains --acl. Remove --acl from alpha.extraFlags (configure alpha.acl.secretFile / alpha.acl.existingSecret instead) so the flag is not passed twice." }}
+{{- end }}
+{{- if and .Values.alpha.encryption.enabled (contains "--encryption" (.Values.alpha.extraFlags | default "")) }}
+{{- fail "alpha.encryption.enabled synthesizes the --encryption superflag, but alpha.extraFlags already contains --encryption. Remove --encryption from alpha.extraFlags (configure alpha.encryption.keyFile / alpha.encryption.existingSecret instead) so the flag is not passed twice." }}
+{{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -210,7 +219,7 @@ spec:
           {{- /* TODO: Remove awk-gsub once dgraph-io/dgraph#6837 is merged and back-ported. */}}
           - |
             set -ex
-            exec dgraph alpha --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):7080 --zero {{ template "multi_zeros" . }} {{ .Values.alpha.extraFlags }}
+            exec dgraph alpha --my=$(hostname -f | awk '{gsub(/\.$/,""); print $0}'):7080 --zero {{ template "multi_zeros" . }} {{ .Values.alpha.extraFlags }}{{- if .Values.alpha.acl.enabled }} --acl "secret-file=/dgraph/acl/{{ .Values.alpha.acl.secretFile }};"{{- end }}{{- if .Values.alpha.encryption.enabled }} --encryption "key-file=/dgraph/enc/{{ .Values.alpha.encryption.keyFile }};"{{- end }}
         resources:
 {{ toYaml .Values.alpha.resources | indent 10 }}
         {{- if .Values.alpha.startupProbe.enabled }}