diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt
index 2356615..21242d9 100644
--- a/charts/spire/templates/NOTES.txt
+++ b/charts/spire/templates/NOTES.txt
@@ -1,4 +1,4 @@
 1. Get the currently registered SPIFFE entries from the server:
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \
-    bin/spire-server entry show -socketPath {{ include "spire.sockets" . }}/registration.sock
+    bin/spire-server entry show -socketPath /run/spire/server-sockets/registration.sock
diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl
index 97fcee0..994a28f 100644
--- a/charts/spire/templates/_helpers.tpl
+++ b/charts/spire/templates/_helpers.tpl
@@ -120,7 +120,3 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
-
-{{- define "spire.sockets" -}}
-{{- "/run/spire/sockets" -}}
-{{- end -}}
diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml
index 577b5c6..fd5d41b 100644
--- a/charts/spire/templates/agent-configmap.yaml
+++ b/charts/spire/templates/agent-configmap.yaml
@@ -10,7 +10,7 @@ data:
       log_level = "{{ .Values.spire.agent.logLevel }}"
       server_address = "{{ include "spire.fullname" . }}-server"
       server_port = "{{ .Values.server.service.port }}"
-      socket_path = "/run/spire/sockets/agent.sock"
+      socket_path = "/run/spire/agent-sockets/agent.sock"
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
     }
diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml
index 17d57a1..ffa8616 100644
--- a/charts/spire/templates/agent-daemonset.yaml
+++ b/charts/spire/templates/agent-daemonset.yaml
@@ -38,8 +38,8 @@ spec:
             - name: spire-bundle
               mountPath: /run/spire/bundle
               readOnly: true
-            - name: spire-agent-socket
-              mountPath: /run/spire/sockets
+            - name: spire-agent-sockets
+              mountPath: /run/spire/agent-sockets
               readOnly: false
             - name: spire-token
               mountPath: /var/run/secrets/tokens
@@ -62,9 +62,9 @@ spec:
         - name: spire-bundle
           configMap:
             name: {{ include "spire.fullname" . }}-bundle
-        - name: spire-agent-socket
+        - name: spire-agent-sockets
           hostPath:
-            path: /run/spire/sockets
+            path: /run/spire/agent-sockets
             type: DirectoryOrCreate
         - name: spire-token
           projected:
diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml
index 97f8bfb..446aa2e 100644
--- a/charts/spire/templates/oidc-deployment.yaml
+++ b/charts/spire/templates/oidc-deployment.yaml
@@ -46,9 +46,9 @@ spec:
             - containerPort: 443
               name: https
           volumeMounts:
-            - name: spire-agent-socket
-              mountPath: {{ include "spire.sockets" . }}
-              readOnly: true
+            - name: spire-oidc-sockets
+              mountPath: /run/spire/oidc-sockets
+              readOnly: false
             - name: spire-oidc-config
               mountPath: /run/spire/oidc/config/
               readOnly: true
@@ -64,9 +64,9 @@ spec:
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       volumes:
-        - name: spire-agent-socket
+        - name: spire-oidc-sockets
           hostPath:
-            path: /run/spire/sockets
+            path: /run/spire/oidc-sockets
             type: DirectoryOrCreate
         - name: spire-oidc-config
           configMap:
diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml
index 215ab35..f782e41 100644
--- a/charts/spire/templates/oidc-dp-configmap.yaml
+++ b/charts/spire/templates/oidc-dp-configmap.yaml
@@ -18,7 +18,7 @@ data:
         email = "{{ .Values.oidc.acme.emailAddress }}"
     }
     workload_api {
-        socket_path = "{{ include "spire.sockets" . }}/agent.sock"
+        socket_path = "/run/spire/agent-sockets/agent.sock"
         trust_domain = "{{ .Values.spire.trustDomain }}"
     }
 {{ end }}
diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml
index e6d1ba6..581e98e 100644
--- a/charts/spire/templates/server-configmap.yaml
+++ b/charts/spire/templates/server-configmap.yaml
@@ -8,7 +8,7 @@ data:
     server {
       bind_address = "0.0.0.0"
       bind_port = "8081"
-      socket_path = "{{ include "spire.sockets" . }}/registration.sock"
+      socket_path = "/run/spire/server-sockets/registration.sock"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
       data_dir = "/run/spire/data"
       log_level = "{{ .Values.spire.server.logLevel }}"
diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml
index 2f08a95..58bcb18 100644
--- a/charts/spire/templates/server-statefulset.yaml
+++ b/charts/spire/templates/server-statefulset.yaml
@@ -47,7 +47,7 @@ spec:
               protocol: TCP
           volumeMounts:
             - name: spire-server-socket
-              mountPath: {{ include "spire.sockets" . }}
+              mountPath: /run/spire/server-sockets
               readOnly: false
             - name: spire-config
               mountPath: /run/spire/config
@@ -86,7 +86,7 @@ spec:
               name: registrar-port
           volumeMounts:
             - name: spire-server-socket
-              mountPath: {{ include "spire.sockets" . }}
+              mountPath: /run/spire/server-sockets
               readOnly: true
             - name: spire-workload-registrar-config
               mountPath: /run/spire/k8s-workload-registrar/config
diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml
index 0e08f0a..71dfc3e 100644
--- a/charts/spire/templates/workload-registrar-configmap.yaml
+++ b/charts/spire/templates/workload-registrar-configmap.yaml
@@ -9,6 +9,6 @@ data:
     mode            = "reconcile"
     trust_domain    = {{ .Values.spire.trustDomain | quote }}
     cluster         = {{ .Values.spire.clusterName | quote }}
-    server_address  = "unix://{{ include "spire.sockets" . }}/registration.sock"
+    server_address  = "unix:///run/spire/server-sockets/registration.sock"
     leader_election = true
     metrics_addr    = "0.0.0.0:18080"