diff --git a/internal/cmd/catalog_add.go b/internal/cmd/catalog_add.go
index 92d3f5ec..f950edb9 100644
--- a/internal/cmd/catalog_add.go
+++ b/internal/cmd/catalog_add.go
@@ -2,8 +2,10 @@ package cmd
 
 import (
 	"io"
+	"strings"
 	"time"
 
+	"github.com/operator-framework/api/pkg/operators/v1alpha1"
 	"github.com/operator-framework/operator-registry/pkg/image/containerdregistry"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
@@ -18,6 +20,8 @@ func newCatalogAddCmd(cfg *action.Configuration) *cobra.Command {
 	a := internalaction.NewCatalogAdd(cfg)
 	a.Logf = log.Printf
 
+	var extractContentStr string
+
 	cmd := &cobra.Command{
 		Use:   "add <name> <index_image>",
 		Short: "Add an operator catalog",
@@ -33,6 +37,28 @@ func newCatalogAddCmd(cfg *action.Configuration) *cobra.Command {
 			a.CatalogSourceName = args[0]
 			a.IndexImage = args[1]
 
+			if extractContentStr != "" {
+				extractContentSettings := strings.Split(extractContentStr, ",")
+				extractContentMap := map[string]string{}
+				for _, setting := range extractContentSettings {
+					key, value, ok := strings.Cut(setting, "=")
+					if !ok {
+						log.Fatalf("invalid extract content setting %q: found key without value", setting)
+					}
+					extractContentMap[key] = value
+				}
+				if catalogDir, ok := extractContentMap["catalog"]; !ok {
+					log.Fatal("invalid extract content: catalog not found")
+				} else if cacheDir, ok := extractContentMap["cache"]; !ok {
+					log.Fatal("invalid extract content: cache not found")
+				} else {
+					a.ExtractContent = &v1alpha1.ExtractContentConfig{
+						CatalogDir: catalogDir,
+						CacheDir:   cacheDir,
+					}
+				}
+			}
+
 			cs, err := a.Run(cmd.Context())
 			if err != nil {
 				log.Fatalf("failed to add catalog: %v", err)
@@ -41,6 +67,7 @@ func newCatalogAddCmd(cfg *action.Configuration) *cobra.Command {
 		},
 	}
 	bindCatalogAddFlags(cmd.Flags(), a)
+	cmd.Flags().StringVar(&extractContentStr, "extract-content", "", "Use OLM-provided catalog server with provided paths (e.g. --extract-content=catalog=/configs,cache=/tmp/cache)")
 
 	return cmd
 }
@@ -48,6 +75,7 @@ func newCatalogAddCmd(cfg *action.Configuration) *cobra.Command {
 func bindCatalogAddFlags(fs *pflag.FlagSet, a *internalaction.CatalogAdd) {
 	fs.StringVarP(&a.DisplayName, "display-name", "d", "", "display name of the index")
 	fs.StringVarP(&a.Publisher, "publisher", "p", "", "publisher of the index")
+	fs.StringVar(&a.SecurityContextConfig, "security-context-config", "restricted", "security context config to use to run the catalog")
 	fs.DurationVar(&a.CleanupTimeout, "cleanup-timeout", time.Minute, "the amount of time to wait before cancelling cleanup")
 
 	fs.StringArrayVarP(&a.InjectBundles, "inject-bundles", "b", nil, "inject extra bundles into the index at runtime")
diff --git a/internal/pkg/action/catalog_add.go b/internal/pkg/action/catalog_add.go
index 0c863c2e..b10c5dfd 100644
--- a/internal/pkg/action/catalog_add.go
+++ b/internal/pkg/action/catalog_add.go
@@ -41,13 +41,15 @@ const (
 type CatalogAdd struct {
 	config *action.Configuration
 
-	CatalogSourceName string
-	IndexImage        string
-	InjectBundles     []string
-	InjectBundleMode  string
-	DisplayName       string
-	Publisher         string
-	CleanupTimeout    time.Duration
+	CatalogSourceName     string
+	IndexImage            string
+	InjectBundles         []string
+	InjectBundleMode      string
+	DisplayName           string
+	Publisher             string
+	SecurityContextConfig string
+	ExtractContent        *v1alpha1.ExtractContentConfig
+	CleanupTimeout        time.Duration
 
 	Logf            func(string, ...interface{})
 	RegistryOptions []containerdregistry.RegistryOption
@@ -87,9 +89,18 @@ func (a *CatalogAdd) Run(ctx context.Context) (*v1alpha1.CatalogSource, error) {
 
 	a.setDefaults(labels)
 
+	grpcPodConfig := &v1alpha1.GrpcPodConfig{}
+	if a.SecurityContextConfig != "" {
+		grpcPodConfig.SecurityContextConfig = v1alpha1.SecurityConfig(a.SecurityContextConfig)
+	}
+	if a.ExtractContent != nil {
+		grpcPodConfig.ExtractContent = a.ExtractContent
+	}
+
 	opts := []catalogsource.Option{
 		catalogsource.DisplayName(a.DisplayName),
 		catalogsource.Publisher(a.Publisher),
+		catalogsource.GRPCPodConfig(grpcPodConfig),
 	}
 
 	if len(a.InjectBundles) == 0 {
diff --git a/internal/pkg/catalogsource/catalogsource.go b/internal/pkg/catalogsource/catalogsource.go
index e80fc4b5..342ac3d8 100644
--- a/internal/pkg/catalogsource/catalogsource.go
+++ b/internal/pkg/catalogsource/catalogsource.go
@@ -25,6 +25,12 @@ func Publisher(v string) Option {
 	}
 }
 
+func GRPCPodConfig(grpcPodConfig *v1alpha1.GrpcPodConfig) Option {
+	return func(cs *v1alpha1.CatalogSource) {
+		cs.Spec.GrpcPodConfig = grpcPodConfig
+	}
+}
+
 func Build(key types.NamespacedName, opts ...Option) *v1alpha1.CatalogSource {
 	cs := &v1alpha1.CatalogSource{
 		ObjectMeta: metav1.ObjectMeta{