diff --git a/deploy/chart/templates/ccm-linode.yaml b/deploy/chart/templates/ccm-linode.yaml
index 6aed9c85..c9b4b77f 100644
--- a/deploy/chart/templates/ccm-linode.yaml
+++ b/deploy/chart/templates/ccm-linode.yaml
@@ -1,11 +1,15 @@
-{{- if not .Values.secretRef }}
+{{/*
+Create a Secret when apiToken is provided. Leave apiToken empty and set
+secretRef.name to use an externally managed Secret instead.
+*/}}
+{{- if .Values.apiToken }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: ccm-linode
-  namespace: {{ required ".Values.namespace required" .Values.namespace }}
+  name: {{ .Values.secretRef.name | quote }}
+  namespace: {{ required ".Values.namespace required" .Values.namespace | quote }}
 stringData:
-  apiToken: {{ required ".Values.apiToken required" .Values.apiToken }}
-  region: {{ required ".Values.region required" .Values.region }}
+  {{ .Values.secretRef.apiTokenRef | quote }}: {{ required ".Values.apiToken required" .Values.apiToken | quote }}
+  {{ .Values.secretRef.regionRef | quote }}: {{ required ".Values.region required" .Values.region | quote }}
 type: Opaque
 {{- end }}
diff --git a/deploy/chart/templates/daemonset.yaml b/deploy/chart/templates/daemonset.yaml
index 4fed5944..2cca11c3 100644
--- a/deploy/chart/templates/daemonset.yaml
+++ b/deploy/chart/templates/daemonset.yaml
@@ -1,17 +1,10 @@
 apiVersion: apps/v1
 kind: DaemonSet
-{{- $secretName := "ccm-linode" }}
-{{- $apiTokenKey := "apiToken" }}
-{{- $regionKey := "region" }}
-{{- $mountSecret := false }}
-{{- $tokenFilePath := "/var/run/secrets/linode/api-token" }}
-{{- if .Values.secretRef }}
-{{- $secretName = (.Values.secretRef.name | default "ccm-linode") }}
-{{- $apiTokenKey = (.Values.secretRef.apiTokenRef | default "apiToken") }}
-{{- $regionKey = (.Values.secretRef.regionRef | default "region") }}
-{{- $mountSecret = (.Values.secretRef.mountSecret | default false) }}
-{{- $tokenFilePath = (.Values.secretRef.mountPath | default "/var/run/secrets/linode/api-token") }}
-{{- end }}
+{{- $secretName := .Values.secretRef.name }}
+{{- $apiTokenKey := .Values.secretRef.apiTokenRef }}
+{{- $regionKey := .Values.secretRef.regionRef }}
+{{- $mountSecret := .Values.secretRef.mountSecret }}
+{{- $tokenFilePath := .Values.secretRef.mountPath }}
 {{- $tokenFileDir := dir $tokenFilePath }}
 {{- $tokenFileName := base $tokenFilePath }}
 metadata:
diff --git a/deploy/chart/values.yaml b/deploy/chart/values.yaml
index 196fbf01..753933a6 100644
--- a/deploy/chart/values.yaml
+++ b/deploy/chart/values.yaml
@@ -1,20 +1,24 @@
-# apiToken [Required if secretRef is not set] - Must be a Linode APIv4 Personal Access Token with all permissions. (https://cloud.linode.com/profile/tokens)
+# apiToken [Required unless using an externally managed Secret] - Must be a Linode APIv4 Personal Access Token with all permissions. (https://cloud.linode.com/profile/tokens)
+# When set, the chart creates a Secret named secretRef.name. Leave empty if the Secret already exists.
 apiToken: ""
 
-# region [Required if secretRef is not set] - Must be a Linode region. (https://api.linode.com/v4/regions)
+# region [Required when apiToken is set] - Must be a Linode region. (https://api.linode.com/v4/regions)
 region: ""
 
-# Set these values if your APIToken and region are already present in a k8s secret.
-# secretRef:
-#   name: "linode-ccm"
-#   # NOTE: Secrets are namespace-scoped; the referenced secret must be in the same namespace as the DaemonSet/release.
-#   apiTokenRef: "apiToken"
-#   regionRef: "region"
-#   # Enable mounted token file mode. Default false/unset keeps legacy env injection mode.
-#   mountSecret: false
-#   # Optional token file path used when mountSecret=true.
-#   # Defaults to /var/run/secrets/linode/api-token.
-#   mountPath: /var/run/secrets/linode/api-token
+# Secret used by the CCM for the Linode API token (and by the chart-created
+# Secret when apiToken/region are set). Override name/keys when using an existing Secret.
+# Leave apiToken empty and point name at your Secret to use an externally managed one.
+# NOTE: Secrets are namespace-scoped; the referenced secret must be in the same namespace as the DaemonSet/release.
+secretRef:
+  name: "ccm-linode"
+  apiTokenRef: "apiToken"
+  regionRef: "region"
+  # Enable mounted token file mode. Default false keeps legacy LINODE_API_TOKEN env injection via secretKeyRef.
+  # When true, the Secret is mounted and the CCM re-reads the token (with a short cache) so you can
+  # rotate the PAT without restarting CCM pods.
+  mountSecret: false
+  # Token file path used when mountSecret=true.
+  mountPath: /var/run/secrets/linode/api-token
 
 # Ensures the CCM runs on control plane nodes
 affinity: