diff --git a/apis/kubeapplier/v1alpha1/waybill_types.go b/apis/kubeapplier/v1alpha1/waybill_types.go
index 496d4b2d..0e61ee23 100644
--- a/apis/kubeapplier/v1alpha1/waybill_types.go
+++ b/apis/kubeapplier/v1alpha1/waybill_types.go
@@ -17,6 +17,7 @@ type WaybillSpec struct {
 	// that will be passed by kube-applier to kubectl when performing apply
 	// runs.
 	// +required
+	// +kubebuilder:default=kube-applier-delegate-token
 	DelegateServiceAccountSecretRef *string `json:"delegateServiceAccountSecretRef"`
 
 	// DryRun enables the dry-run flag when applying this Waybill.
diff --git a/manifests/base/crd/kube-applier.io_waybills.yaml b/manifests/base/crd/kube-applier.io_waybills.yaml
index 1c4d6500..b8602cb1 100644
--- a/manifests/base/crd/kube-applier.io_waybills.yaml
+++ b/manifests/base/crd/kube-applier.io_waybills.yaml
@@ -80,6 +80,7 @@ spec:
                   applied by scheduled or polling runs.
                 type: boolean
               delegateServiceAccountSecretRef:
+                default: kube-applier-delegate-token
                 description: DelegateServiceAccountSecretRef references a Secret of
                   type kubernetes.io/service-account-token in the same namespace as
                   the Waybill that will be passed by kube-applier to kubectl when