diff --git a/terraform-modules/movement-validator-infra/eks.tf b/terraform-modules/movement-validator-infra/eks.tf
index f678e1b..740771c 100644
--- a/terraform-modules/movement-validator-infra/eks.tf
+++ b/terraform-modules/movement-validator-infra/eks.tf
@@ -40,6 +40,11 @@ resource "aws_eks_cluster" "main" {
   role_arn = aws_iam_role.cluster.arn
   version  = var.kubernetes_version
 
+  access_config {
+    authentication_mode                         = var.cluster_authentication_mode
+    bootstrap_cluster_creator_admin_permissions = true
+  }
+
   vpc_config {
     subnet_ids              = local.control_plane_subnet_ids
     endpoint_private_access = true
diff --git a/terraform-modules/movement-validator-infra/variables.tf b/terraform-modules/movement-validator-infra/variables.tf
index e3fc17f..6159228 100644
--- a/terraform-modules/movement-validator-infra/variables.tf
+++ b/terraform-modules/movement-validator-infra/variables.tf
@@ -14,6 +14,17 @@ variable "kubernetes_version" {
   default     = "1.35"
 }
 
+variable "cluster_authentication_mode" {
+  description = "EKS cluster authentication mode. One of CONFIG_MAP (legacy, aws-auth ConfigMap only), API_AND_CONFIG_MAP (recommended; supports both AWS Access Entries and aws-auth), or API (Access Entries only). Switching is one-way: CONFIG_MAP → API_AND_CONFIG_MAP → API."
+  type        = string
+  default     = "API_AND_CONFIG_MAP"
+
+  validation {
+    condition     = contains(["CONFIG_MAP", "API_AND_CONFIG_MAP", "API"], var.cluster_authentication_mode)
+    error_message = "cluster_authentication_mode must be one of CONFIG_MAP, API_AND_CONFIG_MAP, or API."
+  }
+}
+
 variable "private_subnet_ids" {
   description = "Private subnet IDs for node group"
   type        = list(string)