diff --git a/charts/spire/README.md b/charts/spire/README.md
index 2e762b7..63f87a7 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -284,6 +284,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-agent.waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
 | spire-agent.waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-agent.waitForIt.resources | object | `{}` |  |
+| spire-agent.workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
 | spire-agent.workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | spire-agent.workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 | spire-server.affinity | object | `{}` |  |
diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md
index 3d68cfd..76ffe7f 100644
--- a/charts/spire/charts/spire-agent/README.md
+++ b/charts/spire/charts/spire-agent/README.md
@@ -85,6 +85,7 @@ A Helm chart to install the SPIRE agent.
 | waitForIt.image.tag | string | `"latest-20230517"` | Overrides the image tag |
 | waitForIt.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | waitForIt.resources | object | `{}` |  |
+| workloadAttestors.k8s.disableContainerSelectors | bool | `false` | Set to true if using holdApplicationUntilProxyStarts in Istio |
 | workloadAttestors.k8s.skipKubeletVerification | bool | `true` | If true, kubelet certificate verification is skipped |
 | workloadAttestors.unix.enabled | bool | `false` | enables the Unix workload attestor |
 
diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml
index aa545fc..9adfcc7 100644
--- a/charts/spire/charts/spire-agent/templates/configmap.yaml
+++ b/charts/spire/charts/spire-agent/templates/configmap.yaml
@@ -30,6 +30,7 @@ plugins:
           # Minikube does not have a cert in the cluster CA bundle that
           # can authenticate the kubelet cert, so skip validation.
           skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
+          disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
 
   {{- if .Values.workloadAttestors.unix.enabled }}
     - unix:
diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml
index 9653d91..06b0bae 100644
--- a/charts/spire/charts/spire-agent/values.yaml
+++ b/charts/spire/charts/spire-agent/values.yaml
@@ -137,6 +137,8 @@ workloadAttestors:
   k8s:
     # -- If true, kubelet certificate verification is skipped
     skipKubeletVerification: true
+    # -- Set to true if using holdApplicationUntilProxyStarts in Istio
+    disableContainerSelectors: false
 
 telemetry:
   prometheus: