diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index 0d5f8b2..66d78fc 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -73,6 +73,7 @@ A Helm chart to install the SPIRE agent.
 | `fsGroupFix.image.tag`                                 | Overrides the image tag whose default is the chart appVersion                                                                                                                                     | `latest@sha256:1d3fa92a7ad5cfad6fbc3817bf82d25d0b6b4fa6c9711bcd273ffb3bfc926bce` |
 | `fsGroupFix.resources`                                 | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/                                                                                      | `{}`                                                                             |
 | `keyManager.memory.enabled`                            | Enable the memory based Key Manager                                                                                                                                                               | `true`                                                                           |
+| `keyManager.disk.enabled`                              | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled)                                                                                                       | `false`                                                                          |
 | `nodeAttestor.k8sPSAT.enabled`                         | Enable PSAT k8s Node Attestor                                                                                                                                                                     | `true`                                                                           |
 | `nodeAttestor.httpChallenge.enabled`                   | Enable the http challenge Node Attestor                                                                                                                                                           | `false`                                                                          |
 | `nodeAttestor.httpChallenge.agentname`                 | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.                                                               | `default`                                                                        |
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index a06ce67..120060c 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -19,8 +19,11 @@
 {{-     end }}
 {{-   end }}
 {{- end }}
+{{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") }}
+{{-   fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }}
+{{- end }}
 {{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }}
-{{- fail "The sockets.hostBasePath can not be located under the socketPath direcotry" }}
+{{- fail "The sockets.hostBasePath can not be located under the socketPath directory" }}
 {{- end }}
 {{- end }}
 {{- define "spire-agent.yaml-config" -}}
@@ -121,6 +124,12 @@ plugins:
       plugin_data:
     {{- $keyManagerUsed = add1 $keyManagerUsed }}
     {{- end }}
+    {{- if .Values.keyManager.disk.enabled }}
+    disk:
+      plugin_data:
+        directory: {{ .Values.persistence.hostPath }}
+    {{- $keyManagerUsed = add1 $keyManagerUsed }}
+    {{- end }}
 {{- if ne $keyManagerUsed 1 }}
 {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
 {{- end }}
diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml
index 805c4c0..4b60f34 100644
--- a/charts/spire/charts/spire-agent/templates/daemonset.yaml
+++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml
@@ -9,6 +9,9 @@
 {{- if hasKey .Values.sds "disableSpiffeCertValidation" }}
 {{-   fail "disableSpiffeCertValidation was renamed to disableSPIFFECertValidation. Please update your config." }}
 {{- end }}
+{{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") }}
+{{-   fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }}
+{{- end }}
 {{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }}
 {{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }}
 {{- $nameSuffix := "" }}
@@ -256,6 +259,11 @@ spec:
             - name: spire-config
               mountPath: /opt/spire/conf/agent
               readOnly: true
+            {{- if .Values.keyManager.disk.enabled }}
+            - name: spire-key-manager
+              mountPath: {{ .Values.persistence.hostPath }}
+              readOnly: false
+            {{- end }}
             - name: spire-agent-persistence
               mountPath: /var/lib/spire
             {{- if .Values.sockets.admin.enabled }}
@@ -324,6 +332,12 @@ spec:
         - name: spire-config
           configMap:
             name: {{ include "spire-agent.fullname" . }}
+        {{- if .Values.keyManager.disk.enabled }}
+        - name: spire-key-manager
+          hostPath:
+            path: {{ .Values.persistence.hostPath }}
+            type: DirectoryOrCreate
+        {{- end }}
         {{- if .Values.sockets.admin.mountOnHost }}
         - name: spire-agent-admin-socket-dir
           hostPath:
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index 8a7e621..bba9295 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -162,6 +162,9 @@ keyManager:
   memory:
     ## @param keyManager.memory.enabled Enable the memory based Key Manager
     enabled: true
+  disk:
+    ## @param keyManager.disk.enabled Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled)
+    enabled: false
 
 nodeAttestor:
   k8sPSAT: