diff --git a/docs/content/docs/advanced-topics/helm-deployment.md b/docs/content/docs/advanced-topics/helm-deployment.md
index 20a62984..635dddf2 100644
--- a/docs/content/docs/advanced-topics/helm-deployment.md
+++ b/docs/content/docs/advanced-topics/helm-deployment.md
@@ -52,7 +52,8 @@ Helm is a package manager for Kubernetes, allowing to easily deploy applications
 | `secret.create`                          | Indicates if the secret should be managed by the chart                                                                                                                                                                                                                                                  | `true`                                                                                                                                                          |
 | `secret.name`                            | Secret name                                                                                                                                                                                                                                                                                             | _Release name_                                                                                                                                                  |
 | `secret.azureKeyVault.enabled`           | Indicates if the secret should be synced from Azure Key Vault with pod-managed identities ([more details](https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity))                                                                                                                       | `false`                                                                                                                                                         |
-| `secret.azureKeyVault.managedIdentityId` | ID of the Entra ID managed identity                                                                                                                                                                                                                                                                     | _None_                                                                                                                                                          |
+| `secret.azureKeyVault.useVMManagedIdentity` | Use VM managed identity for authentication; when `true`, uses `userAssignedIdentityID` parameter; when `false`, uses `clientID` parameter with the value from `managedIdentityId`                                                                                                        | _None_                                                                                                                                                           |
+| `secret.azureKeyVault.managedIdentityId` | Client ID of the Entra ID managed identity; used as `clientID` when `useVMManagedIdentity` is `false`, or as `userAssignedIdentityID` when `useVMManagedIdentity` is `true`                                                                                                             | _None_                                                                                                                                                           |
 | `secret.azureKeyVault.name`              | Name of the Azure Key Vault resource                                                                                                                                                                                                                                                                    | _None_                                                                                                                                                          |
 | `secret.azureKeyVault.tenantId`          | Tenant ID of the Azure Key Vault resource                                                                                                                                                                                                                                                               | _None_                                                                                                                                                          |
 | `securityContext`                        | Security rules applied to the container ([more details](https://kubernetes.io/docs/concepts/security/pod-security-standards))                                                                                                                                                                           | `{}`                                                                                                                                                            |
diff --git a/src/helm/blue-agent/templates/_helpers.tpl b/src/helm/blue-agent/templates/_helpers.tpl
index 262f2f69..2138778b 100644
--- a/src/helm/blue-agent/templates/_helpers.tpl
+++ b/src/helm/blue-agent/templates/_helpers.tpl
@@ -315,8 +315,6 @@ volumes:
       readOnly: true
       volumeAttributes:
         secretProviderClass: {{ include "blue-agent.fullname" . }}-azure
-      nodePublishSecretRef:
-        name: {{ include "blue-agent.secretName" . }}
   {{- end }}
   {{- with .Values.extraVolumes }}
   # Custom volumes
diff --git a/src/helm/blue-agent/templates/secret.yaml b/src/helm/blue-agent/templates/secret.yaml
index 296052fc..3dbd860e 100644
--- a/src/helm/blue-agent/templates/secret.yaml
+++ b/src/helm/blue-agent/templates/secret.yaml
@@ -21,7 +21,12 @@ spec:
           key: personalAccessToken
   # Source configuration
   parameters:
+    {{- if .Values.secret.azureKeyVault.useVMManagedIdentity }}
+    useVMManagedIdentity: "true"
+    userAssignedIdentityID: {{ .Values.secret.azureKeyVault.managedIdentityId | quote | required "A value for .Values.secret.azureKeyVault.managedIdentityId is required" }}
+    {{- else }}
     clientID: {{ .Values.secret.azureKeyVault.managedIdentityId | quote | required "A value for .Values.secret.azureKeyVault.managedIdentityId is required" }}
+    {{- end }}
     keyvaultName: {{ .Values.secret.azureKeyVault.name | quote | required "A value for .Values.secret.azureKeyVault.name is required" }}
     tenantID: {{ .Values.secret.azureKeyVault.tenantId | quote | required "A value for .Values.secret.azureKeyVault.tenantId is required" }}
     objects: |
diff --git a/src/helm/blue-agent/values.yaml b/src/helm/blue-agent/values.yaml
index 5ec0e7a0..c4a33667 100644
--- a/src/helm/blue-agent/values.yaml
+++ b/src/helm/blue-agent/values.yaml
@@ -79,6 +79,8 @@ secret:
   azureKeyVault:
     # Indicates if the secret should be synced from Azure Key Vault with pod-managed identities (see: https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity)
     enabled: false
+    # Indicates if VM managed identity should be used
+    useVMManagedIdentity: null
     # ID of the Entra ID managed identity
     managedIdentityId: null
     # Name of the Azure Key Vault resource