diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index 66b052e..0fe91b3 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -48,6 +48,8 @@ A Helm chart to install the SPIRE agent.
 | telemetry.prometheus.podMonitor.labels | object | `{}` |  |
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent |
 | telemetry.prometheus.port | int | `9988` |  |
+| trustBundleFormat | string | `"pem"` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" |
+| trustBundleURL | string | `""` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap |
 | trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
 | waitForIt.image.registry | string | `"cgr.dev"` |  |
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index b04cb88..414dd85 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -5,7 +5,12 @@ agent:
   server_address: {{ include "spire-agent.server-address" . | trim | quote }}
   server_port: {{ .Values.server.port | quote }}
   socket_path: {{ include "spire-agent.socket-path" . | quote }}
+  {{- if ne (len .Values.trustBundleURL) 0 }}
+  trust_bundle_url: {{ .Values.trustBundleURL | quote }}
+  trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
+  {{- else }}
   trust_bundle_path: "/run/spire/bundle/bundle.crt"
+  {{- end }}
   trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
 
 plugins:
diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml
index 19e9437..eafbad1 100644
--- a/charts/spire/charts/spire-agent/templates/daemonset.yaml
+++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml
@@ -62,9 +62,11 @@ spec:
             - name: spire-config
               mountPath: /run/spire/config
               readOnly: true
+            {{- if eq (len .Values.trustBundleURL) 0 }}
             - name: spire-bundle
               mountPath: /run/spire/bundle
               readOnly: true
+            {{- end }}
             - name: spire-agent-socket-dir
               mountPath: {{ include "spire-agent.socket-path" . | dir }}
               readOnly: false
@@ -98,9 +100,11 @@ spec:
         - name: spire-config
           configMap:
             name: {{ include "spire-agent.fullname" . }}
+        {{- if eq (len .Values.trustBundleURL) 0 }}
         - name: spire-bundle
           configMap:
             name: {{ include "spire-lib.bundle-configmap" . }}
+        {{- end }}
         - name: spire-token
           projected:
             sources:
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index 68e6b8a..77a0114 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -55,7 +55,10 @@ nodeSelector: {}
 logLevel: info
 clusterName: example-cluster
 trustDomain: example.org
-
+# -- If set, obtain trust bundle from url instead of Kubernetes ConfigMap
+trustBundleURL: ""
+# -- If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
+trustBundleFormat: pem
 bundleConfigMap: spire-bundle
 
 server: