diff --git a/chart/templates/deployment-worker.yaml b/chart/templates/deployment-worker.yaml
index a4c46e9..ab5947b 100644
--- a/chart/templates/deployment-worker.yaml
+++ b/chart/templates/deployment-worker.yaml
@@ -55,6 +55,10 @@ spec:
               value: worker
             - name: OPS_CONTAINER_TYPE
               value: WORKER
+            {{- if .Values.worker.awsWebIdentity.enabled }}
+            - name: OPS_AWS_WEB_IDENTITY_TOKEN_FILE
+              value: {{ printf "%s/token" (trimSuffix "/" .Values.worker.awsWebIdentity.mountPath) | quote }}
+            {{- end }}
 {{ include "openops.renderEnv" (dict "root" . "env" .Values.openopsEnv "skipDuplicateSecrets" true) | nindent 12 }}
 {{ include "openops.renderEnv" (dict "root" . "env" .Values.openopsEnvSecrets) | nindent 12 }}
 {{ include "openops.renderEnv" (dict "root" . "env" .Values.worker.env) | nindent 12 }}
@@ -71,8 +75,22 @@ spec:
             mountPath: /tmp/.npm
           - name: tmp-codes
             mountPath: /tmp/codes
+          {{- if .Values.worker.awsWebIdentity.enabled }}
+          - name: aws-web-identity-token
+            mountPath: {{ .Values.worker.awsWebIdentity.mountPath }}
+            readOnly: true
+          {{- end }}
       volumes:
       - name: npm-cache
         emptyDir: {}
       - name: tmp-codes
         emptyDir: {}
+      {{- if .Values.worker.awsWebIdentity.enabled }}
+      - name: aws-web-identity-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: {{ .Values.worker.awsWebIdentity.audience | quote }}
+              expirationSeconds: {{ .Values.worker.awsWebIdentity.expirationSeconds }}
+      {{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
index 67366ff..de5963b 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -254,6 +254,16 @@ worker:
     create: true
     name: ""
     annotations: {}
+  # Exchange a projected service account token for AWS credentials, the way IRSA
+  # does on EKS. Enabling this projects the token and sets
+  # OPS_AWS_WEB_IDENTITY_TOKEN_FILE to match; you supply the role it federates
+  # into as OPS_AWS_FEDERATION_ROLE_ARN in openopsEnv.
+  # Leave disabled on EKS: IRSA injects its own token and the AWS SDK finds it.
+  awsWebIdentity:
+    enabled: false
+    audience: sts.amazonaws.com
+    expirationSeconds: 3600
+    mountPath: /var/run/secrets/aws
   # Prometheus metrics
   metrics:
     enabled: true