diff --git a/charts/apisix/Chart.yaml b/charts/apisix/Chart.yaml
index 0702fdd0..b05233ff 100644
--- a/charts/apisix/Chart.yaml
+++ b/charts/apisix/Chart.yaml
@@ -31,12 +31,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.17.1
+version: 2.18.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 3.18.0
+appVersion: 3.19.0
 sources:
   - https://github.com/apache/apisix-helm-chart
 
diff --git a/charts/apisix/README.md b/charts/apisix/README.md
index d1a396d0..56cababd 100644
--- a/charts/apisix/README.md
+++ b/charts/apisix/README.md
@@ -249,7 +249,7 @@ The command removes all the Kubernetes components associated with the chart and
 | hostNetwork | bool | `false` | Use the host's network namespace |
 | image.pullPolicy | string | `"IfNotPresent"` | Apache APISIX image pull policy |
 | image.repository | string | `"apache/apisix"` | Apache APISIX image repository |
-| image.tag | string | `"3.18.0-ubuntu"` | Apache APISIX image tag Overrides the image tag whose default is the chart appVersion. |
+| image.tag | string | `"3.19.0-ubuntu"` | Apache APISIX image tag Overrides the image tag whose default is the chart appVersion. |
 | ingress | object | `{"annotations":{},"enabled":false,"hosts":[{"host":"apisix.local","paths":[]}],"servicePort":null,"tls":[]}` | Using ingress access Apache APISIX service |
 | ingress-controller | object | `{"enabled":false,"webhook":{"enabled":false}}` | Ingress controller configuration |
 | ingress-controller.enabled | bool | `false` | Enable the apisix-ingress-controller sub-chart |
@@ -271,11 +271,11 @@ The command removes all the Kubernetes components associated with the chart and
 | nameOverride | string | `""` | String to partially override the chart fullname |
 | nodeSelector | object | `{}` | Node labels for Apache APISIX pod assignment |
 | podAnnotations | object | `{}` | Annotations to add to each pod |
-| podLabels | object | `{}` | Labels to add to each pod |
 | podDisruptionBudget | object | `{"enabled":false,"maxUnavailable":1,"minAvailable":"90%"}` | See https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more details |
 | podDisruptionBudget.enabled | bool | `false` | Enable or disable podDisruptionBudget |
 | podDisruptionBudget.maxUnavailable | int | `1` | Set the maxUnavailable of podDisruptionBudget |
 | podDisruptionBudget.minAvailable | string | `"90%"` | Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget. See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget) for more details |
+| podLabels | object | `{}` | Labels to add to each pod |
 | podSecurityContext | object | `{}` | Set the securityContext for Apache APISIX pods |
 | priorityClassName | string | `""` | Set [priorityClassName](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) for Apache APISIX pods |
 | rbac.create | bool | `false` | Whether RBAC resources (ClusterRole and ClusterRoleBinding) should be created |
@@ -293,7 +293,7 @@ The command removes all the Kubernetes components associated with the chart and
 | service.labelsOverride | object | `{}` | Override default labels assigned to Apache APISIX gateway resources |
 | service.stream | object | `{"enabled":false,"tcp":[],"udp":[]}` | Apache APISIX service settings for stream. L4 proxy (TCP/UDP) |
 | service.stream.enabled | bool | `false` | Enable the stream (L4 proxy) subsystem |
-| service.stream.tcp | list | `[]` | TCP proxy port list, element format: port number, or a map with `addr` and optional `tls` |
+| service.stream.tcp | list | `[]` | TCP proxy port list, element format: port number, or a map with `addr` and optional `tls` / `tls_passthrough` |
 | service.stream.udp | list | `[]` | UDP proxy port list |
 | service.tls | object | `{"servicePort":443}` | Apache APISIX service settings for tls |
 | service.tls.servicePort | int | `443` | Kubernetes service port for HTTPS traffic |
diff --git a/charts/apisix/templates/configmap.yaml b/charts/apisix/templates/configmap.yaml
index 8739d729..dba67cb7 100644
--- a/charts/apisix/templates/configmap.yaml
+++ b/charts/apisix/templates/configmap.yaml
@@ -140,6 +140,9 @@ data:
           {{- if hasKey . "tls" }}
             tls: {{ .tls }}
           {{- end }}
+          {{- if hasKey . "tls_passthrough" }}
+            tls_passthrough: {{ .tls_passthrough }}
+          {{- end }}
           {{- else }}
           - {{ . }}
           {{- end }}
diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml
index 24356d10..c4ab140e 100644
--- a/charts/apisix/values.yaml
+++ b/charts/apisix/values.yaml
@@ -29,7 +29,7 @@ image:
   pullPolicy: IfNotPresent
   # -- Apache APISIX image tag
   # Overrides the image tag whose default is the chart appVersion.
-  tag: 3.18.0-ubuntu
+  tag: 3.19.0-ubuntu
 
 # -- set false to use `Deployment`, set true to use `DaemonSet`
 useDaemonSet: false
@@ -224,7 +224,7 @@ service:
   stream:
     # -- Enable the stream (L4 proxy) subsystem
     enabled: false
-    # -- TCP proxy port list, element format: port number, or a map with `addr` and optional `tls`
+    # -- TCP proxy port list, element format: port number, or a map with `addr` and optional `tls` / `tls_passthrough`
     tcp: []
     # -- UDP proxy port list
     udp: []