diff --git a/charts/workflows-cluster/Chart.yaml b/charts/workflows-cluster/Chart.yaml
index edfa1edf4..f5b7f83bc 100644
--- a/charts/workflows-cluster/Chart.yaml
+++ b/charts/workflows-cluster/Chart.yaml
@@ -3,7 +3,7 @@ name: workflows-cluster
 description: A virtual cluster for Data Analysis workflows
 type: application
 
-version: 0.13.24
+version: 0.13.25
 dependencies:
   - name: common
     version: 2.23.0
diff --git a/charts/workflows-cluster/values.yaml b/charts/workflows-cluster/values.yaml
index 4f59cb7d1..f055dc946 100644
--- a/charts/workflows-cluster/values.yaml
+++ b/charts/workflows-cluster/values.yaml
@@ -269,6 +269,15 @@ authenticationConfiguration:
             ['k6Operator'].exists(allowed, allowed == claims.client_id)
           )
         message: "Invalid access token (service account not on allowed-list). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/"
+      - expression: >
+          claims.?posix_uid.hasValue()
+          ||
+          (
+            claims.?client_id.hasValue()
+            &&
+            ['k6Operator'].exists(allowed, allowed == claims.client_id)
+          )
+        message: "Invalid access token (missing posix-uid). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/"
     userValidationRules:
       - expression: "!user.username.startsWith('system:')"
         message: "username cannot use reserved system: prefix"