diff --git a/kubectl-minio/cmd/resources/tenant.go b/kubectl-minio/cmd/resources/tenant.go
index e3e3e570fcd..69e3b81bcb7 100644
--- a/kubectl-minio/cmd/resources/tenant.go
+++ b/kubectl-minio/cmd/resources/tenant.go
@@ -36,6 +36,7 @@ type TenantOptions struct {
 	Capacity                string
 	NS                      string
 	Image                   string
+	KesImage                string
 	StorageClass            string
 	KmsSecret               string
 	ConsoleSecret           string
@@ -79,11 +80,11 @@ func tenantKESLabels(name string) map[string]string {
 	return m
 }
 
-func tenantKESConfig(tenant, secret string) *miniov2.KESConfig {
+func tenantKESConfig(tenant, secret, kesImage string) *miniov2.KESConfig {
 	if secret != "" {
 		return &miniov2.KESConfig{
 			Replicas: helpers.KESReplicas,
-			Image:    helpers.DefaultKESImage,
+			Image:    kesImage,
 			Configuration: &v1.LocalObjectReference{
 				Name: secret,
 			},
@@ -130,7 +131,7 @@ func NewTenant(opts *TenantOptions, userSecret *v1.Secret) (*miniov2.Tenant, err
 			Pools:           []miniov2.Pool{Pool(opts, volumesPerServer, *capacityPerVolume)},
 			RequestAutoCert: &autoCert,
 			Mountpath:       helpers.MinIOMountPath,
-			KES:             tenantKESConfig(opts.Name, opts.KmsSecret),
+			KES:             tenantKESConfig(opts.Name, opts.KmsSecret, opts.KesImage),
 			ImagePullSecret: v1.LocalObjectReference{Name: opts.ImagePullSecret},
 			Users: []*v1.LocalObjectReference{
 				{
diff --git a/kubectl-minio/cmd/tenant-create.go b/kubectl-minio/cmd/tenant-create.go
index b03c18f5f5f..1679a8c0503 100644
--- a/kubectl-minio/cmd/tenant-create.go
+++ b/kubectl-minio/cmd/tenant-create.go
@@ -84,6 +84,7 @@ func newTenantCreateCmd(out io.Writer, errOut io.Writer) *cobra.Command {
 	f.StringVarP(&c.tenantOpts.NS, "namespace", "n", "", "k8s namespace for this MinIO tenant")
 	f.StringVarP(&c.tenantOpts.StorageClass, "storage-class", "s", helpers.DefaultStorageclass, "storage class for this MinIO tenant")
 	f.StringVarP(&c.tenantOpts.Image, "image", "i", helpers.DefaultTenantImage, "custom MinIO image for this tenant")
+	f.StringVarP(&c.tenantOpts.KesImage, "kes-image", "", helpers.DefaultKESImage, "custom KES image for this tenant")
 	f.StringVarP(&c.tenantOpts.ImagePullSecret, "image-pull-secret", "", "", "image pull secret to be used for pulling MinIO")
 	f.BoolVar(&c.tenantOpts.DisableAntiAffinity, "enable-host-sharing", false, "[TESTING-ONLY] disable anti-affinity to allow pods to be co-located on a single node (unsupported in production environment)")
 	f.StringVar(&c.tenantOpts.KmsSecret, "kes-config", "", "name of secret for KES KMS setup, refer https://github.com/minio/operator/blob/master/examples/kes-secret.yaml")