diff --git a/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackend.java b/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackend.java
index 426a947ce..5758acb77 100644
--- a/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackend.java
+++ b/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackend.java
@@ -94,4 +94,8 @@ public interface VaultJWEBackend {
 
 	@JsonProperty("password")
 	Optional<String> password();
+
+	// (4) misc
+	@JsonProperty("automaticAccessGrant")
+	Optional<Boolean> automaticAccessGrant();
 }
diff --git a/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackendDto.java b/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackendDto.java
index e04098ec9..32b761113 100644
--- a/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackendDto.java
+++ b/backend/src/main/java/org/cryptomator/hub/api/cipherduck/VaultJWEBackendDto.java
@@ -69,7 +69,11 @@ public record VaultJWEBackendDto(
 		// (3) keychain credentials
 		Optional<String> username,
 
-		Optional<String> password) implements VaultJWEBackend {
+		Optional<String> password,
+
+		// (4) misc
+		Optional<Boolean> automaticAccessGrant
+) implements VaultJWEBackend {
 
 
 	public VaultJWEBackendDto(VaultJWEBackend s, final String oAuthAuthorizationUrl, final String oAuthTokenUrl, final String oAuthClientId, final String oAuthTokenExchangeAudience, final String hubId) {
@@ -97,6 +101,8 @@ public VaultJWEBackendDto(VaultJWEBackend s, final String oAuthAuthorizationUrl,
 				Optional.of(hubId),
 				Optional.of(oAuthTokenExchangeAudience),
 				s.username(),
-				s.password());
+				s.password(),
+				s.automaticAccessGrant()
+				);
 	}
 }
diff --git a/frontend/src/components/CreateVaultS3.vue b/frontend/src/components/CreateVaultS3.vue
index 10f87f0ca..d8ab5c01a 100644
--- a/frontend/src/components/CreateVaultS3.vue
+++ b/frontend/src/components/CreateVaultS3.vue
@@ -193,6 +193,11 @@
                     </label>
                     <input id="vaultSecretKey" v-model="vaultSecretKey" :disabled="processing" type="text" class="mt-1 focus:ring-primary focus:border-primary block w-full shadow-sm sm:text-sm border-gray-300 rounded-md disabled:bg-gray-200"/>
                 </div>
+                <br/>
+                <div class="col-span-6 sm:col-span-3">
+                    <label for="vaultName" class="block text-sm font-medium text-gray-700">{{ t('CreateVaultS3.enterVaultDetails.automaticAccessGrant') }}</label>
+                    <input id="automaticAccessGrant" v-model="automaticAccessGrant" name="automaticAccessGrant" type="checkbox" class="h-4 w-4 rounded border-gray-300 text-primary focus:ring-primary" required>
+                </div>
             </div>
           </div>
         </div>
@@ -385,6 +390,7 @@ const apiConfig = ref('');
 const vaultAccessKeyId = ref('');
 const vaultSecretKey = ref('');
 const vaultBucketName = ref('');
+const automaticAccessGrant = ref('true');
 // \ cipherduck extension
 onMounted(initialize);
 
@@ -463,6 +469,7 @@ async function createVault() {
     config["jwe"]["defaultPath"] = config["bucketPrefix"] + vaultId;
     config["jwe"]["uuid"] = vaultId;
     config["jwe"]["nickname"] = vaultName.value;
+    config["jwe"]["automaticAccessGrant"] = automaticAccessGrant.value;
 
     if(isPermanent.value){
         config["jwe"]["username"] = vaultAccessKeyId.value;
diff --git a/frontend/src/i18n/de-DE.json b/frontend/src/i18n/de-DE.json
index 1cd63647d..8c5c0a789 100644
--- a/frontend/src/i18n/de-DE.json
+++ b/frontend/src/i18n/de-DE.json
@@ -240,6 +240,7 @@
 
   "CreateVaultS3.enterVaultDetails.storage": "Tresor-Speicherbereich",
   "CreateVaultS3.enterVaultDetails.region": "Region",
+  "CreateVaultS3.enterVaultDetails.automaticAccessGrant": "Automatische Zugriffsfreigabe",
   "CreateVaultS3.enterVaultDetails.vaultPermanentAccessKeyId": "Benutzername (S3 AccessKeyId)",
   "CreateVaultS3.enterVaultDetails.vaultPermanentSecretKey": "Passwort (S3 SecretKey)",
   "CreateVaultS3.enterVaultDetails.vaultPermanentBucketName": "S3 Bucket-Name (existing)",
diff --git a/frontend/src/i18n/en-US.json b/frontend/src/i18n/en-US.json
index 60b27536f..d23b653ba 100644
--- a/frontend/src/i18n/en-US.json
+++ b/frontend/src/i18n/en-US.json
@@ -241,6 +241,7 @@
 
   "CreateVaultS3.enterVaultDetails.storage": "Vault storage location",
   "CreateVaultS3.enterVaultDetails.region": "Region",
+  "CreateVaultS3.enterVaultDetails.automaticAccessGrant": "Automatically Grant Vault Access",
   "CreateVaultS3.enterVaultDetails.vaultPermanentAccessKeyId": "Username (S3 AccessKeyId)",
   "CreateVaultS3.enterVaultDetails.vaultPermanentSecretKey": "Password (S3 SecretKey)",
   "CreateVaultS3.enterVaultDetails.vaultPermanentBucketName": "S3 Bucket name (existing)",