diff --git a/marketplaces/charts/operator-eks-addon/README.md b/marketplaces/charts/operator-eks-addon/README.md
index 3ca882a2e5..b994006bc5 100644
--- a/marketplaces/charts/operator-eks-addon/README.md
+++ b/marketplaces/charts/operator-eks-addon/README.md
@@ -1,6 +1,23 @@
 # Operator EKS Add-on
 
-This is a wrapper chart for installing EKS add-on. Charts required for the add-on are added as a dependency to this chart. Chart itself doesn't contain any templates or configurable properties.
+This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency.
+
+## Managed Agent installation credentials sync
+
+The optional `managedAgentInstallationCredentials` value renders the resources that sync a Datadog API key from AWS Secrets Manager into `datadog-secret[api-key]` in the add-on namespace:
+
+- `ServiceAccount/datadog-ascp-sync`
+- `SecretProviderClass/datadog-api-key`
+- a Linux-only `Deployment/datadog-ascp-secret-sync` that keeps the CSI volume mounted
+
+The cluster must have the AWS Secrets Store CSI Driver provider and EKS Pod Identity Agent add-ons installed. The CSI driver must enable Kubernetes Secret sync, and the sync ServiceAccount must have an EKS Pod Identity association whose IAM role can read the configured Secrets Manager secret. The add-on namespace and Pod Identity association namespace must match. The sync Deployment requires a Linux EC2 node because the AWS provider does not support Fargate.
+
+Enable the CSI driver's rotation reconciler if updates to the Secrets Manager value must propagate to `datadog-secret` without restarting the sync Deployment.
+
+```yaml
+managedAgentInstallationCredentials:
+  secretsManagerSecretID: arn:aws:secretsmanager:us-east-1:123456789012:secret:/datadog/eks-instrumenter/123456789012/example
+```
 
 ## Version Mapping
 | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent |
diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json
index 880afe4e2c..0220e5451e 100644
--- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json
+++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json
@@ -118,6 +118,23 @@
           "type": "object"
         }
       }
+    },
+    "managedAgentInstallationCredentials": {
+      "type": [
+        "object",
+        "null"
+      ],
+      "properties": {
+        "secretsManagerSecretID": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048
+        }
+      },
+      "required": [
+        "secretsManagerSecretID"
+      ],
+      "additionalProperties": false
     }
   }
-}
\ No newline at end of file
+}
diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml
new file mode 100644
index 0000000000..9d218c607a
--- /dev/null
+++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml
@@ -0,0 +1,104 @@
+{{- with .Values.managedAgentInstallationCredentials }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: datadog-ascp-sync
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: datadog-ascp-secret-sync
+    app.kubernetes.io/managed-by: eks-addon
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: datadog-api-key
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: datadog-ascp-secret-sync
+    app.kubernetes.io/managed-by: eks-addon
+spec:
+  provider: aws
+  secretObjects:
+    - secretName: datadog-secret
+      type: Opaque
+      labels:
+        app.kubernetes.io/managed-by: eks-addon
+      data:
+        - objectName: api-key
+          key: api-key
+  parameters:
+    usePodIdentity: "true"
+    objects: |
+      - objectName: {{ .secretsManagerSecretID | quote }}
+        objectType: secretsmanager
+        objectAlias: api-key
+        filePermission: "0400"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: datadog-ascp-secret-sync
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: datadog-ascp-secret-sync
+    app.kubernetes.io/managed-by: eks-addon
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: datadog-ascp-secret-sync
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: datadog-ascp-secret-sync
+        app.kubernetes.io/managed-by: eks-addon
+    spec:
+      serviceAccountName: datadog-ascp-sync
+      nodeSelector:
+        kubernetes.io/os: linux
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: eks.amazonaws.com/compute-type
+                    operator: NotIn
+                    values:
+                      - fargate
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: secret-sync
+          image: public.ecr.aws/amazonlinux/amazonlinux:2023
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args: ["trap : TERM INT; sleep infinity & wait"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 50m
+              memory: 64Mi
+          volumeMounts:
+            - name: datadog-api-key
+              mountPath: /mnt/datadog-api-key
+              readOnly: true
+      volumes:
+        - name: datadog-api-key
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: datadog-api-key
+{{- end }}
diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml
index 2ff26d5f4f..9d16658447 100644
--- a/marketplaces/charts/operator-eks-addon/values.yaml
+++ b/marketplaces/charts/operator-eks-addon/values.yaml
@@ -7,3 +7,5 @@ datadog-operator:
     repository: 709825985650.dkr.ecr.us-east-1.amazonaws.com/datadog/operator
     tag: 1.28.0
   operatorMetricsEnabled: false
+
+managedAgentInstallationCredentials: null