diff --git a/infrastructure/aws/iam/cert_manager/.terraform.lock.hcl b/infrastructure/aws/iam/cert_manager/.terraform.lock.hcl
new file mode 100644
index 00000000..821b0484
--- /dev/null
+++ b/infrastructure/aws/iam/cert_manager/.terraform.lock.hcl
@@ -0,0 +1,25 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/aws" {
+  version     = "6.52.0"
+  constraints = ">= 6.28.0"
+  hashes = [
+    "h1:8H3TGxUyZ83L8spIqyrPez0BqCUAlZEd+7Y7O60/xOk=",
+    "zh:0ad03e39cef9ca83c7663efcf618eb49dd72e5930406311ec063595551e1afab",
+    "zh:24f831fa500a7778ffcb7d770250bb20caa0c86506651ed7b4ce82bf4743edfc",
+    "zh:270188d0e43e14ed74cce315e73ade0afd1bda36a5d3626270109529614f4d9e",
+    "zh:387154e5bdb49a825739414a7b859865d10411677ef9eb3f8c082709a91ac2e8",
+    "zh:3d458b379c48d67dfd50188df05f9477c752ed0913c52d342f3d311e51980d05",
+    "zh:40f5d2056829d48080abc1081cf1747724bacdc86764a5ee02422734adb15e08",
+    "zh:57837cc69ad9c1959186150b3705ca1f34e6542e8f05ae106eb747577617d8b3",
+    "zh:81d3e77d89c8819a4ceaa94b6200679a4e4d2d682c6204003a2a18d0fd587761",
+    "zh:8823b3663c5b4ec5c3bb18ccacd6aa919c52dfa876cc850afc25c4f1fdf453bc",
+    "zh:8999caef5b21d7794a216dd43265a851b098dd73e11a62022ceb2ecb8b89f172",
+    "zh:915621a7335e9d351a62a6ffabf396df98b4f116fb12a31bf4c6747e1ecc7e55",
+    "zh:9f7264c34db8d6a00bacb0119bd284f18c43a4617427703650719be25fae4b2d",
+    "zh:ba466658cf7e5549582b0eb8ed8ddce52b2ecdd5b31da94849f66cc8fa1f18e1",
+    "zh:befccb34cb734687e95211606931c09a24f403bb634087743cf75f058c944200",
+    "zh:fa749a6535df4020d90a4767fee943fdd9c606938ce4f4e1136e8ae6ba437a85",
+  ]
+}
diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md
index d9b2f9aa..cb5b2dc6 100644
--- a/infrastructure/aws/iam/cert_manager/README.md
+++ b/infrastructure/aws/iam/cert_manager/README.md
@@ -2,23 +2,25 @@
 
 ## Description
 
-Creates an IAM role and policy for cert-manager on EKS, enabling DNS01 ACME challenge validation via Route53 hosted zones using IRSA
+Creates an IAM role and policy for cert-manager on EKS, enabling DNS01 ACME challenge validation via Route53. Supports both IRSA (OIDC federation) and EKS Pod Identity as the identity mechanism.
 
 ## Architecture
 
-An aws_iam_policy is created granting Route53 permissions (GetChange, ChangeResourceRecordSets, ListResourceRecordSets, ListHostedZonesByName) scoped to the provided public and/or private hosted zone ARNs. The terraform-aws-modules/iam iam-role-for-service-accounts module creates an aws_iam_role with an OIDC trust policy bound to the cert-manager Kubernetes service account in the cert-manager namespace. The OIDC provider ARN and cluster name flow into the role naming and trust relationship, while the hosted zone IDs are dynamically filtered and converted to ARNs via a local for expression. The role ARN is exposed as an output for use by the cert-manager Helm release or Kubernetes service account annotation.
+An aws_iam_policy is created granting Route53 permissions (GetChange, ChangeResourceRecordSets, ListResourceRecordSets, ListHostedZonesByName) scoped to the provided public and/or private hosted zone ARNs. The `identity_mode` variable selects the authentication mechanism: in `irsa` mode the terraform-aws-modules/iam community module creates an aws_iam_role with an OIDC trust policy; in `pod_identity` mode a native aws_iam_role is created with a trust policy for `pods.eks.amazonaws.com` and an `aws_eks_pod_identity_association` binds it to the cert-manager service account. The role ARN is exposed as an output in both modes.
 
 ## Features
 
-- Creates an IAM role with OIDC trust scoped to the cert-manager Kubernetes service account via IRSA
+- Supports IRSA (OIDC) and EKS Pod Identity via `identity_mode` variable (default: `irsa`)
 - Creates an IAM policy granting Route53 permissions required for DNS01 ACME challenge validation
 - Supports both public and private Route53 hosted zones with dynamic ARN construction
 - Enforces that at least one of public or private hosted zone IDs is provided via input validation
 - Scopes Route53 ChangeResourceRecordSets and ListResourceRecordSets permissions to only the specified hosted zones
-- Outputs the cert-manager IAM role ARN for use in service account annotations or Helm chart values
+- Outputs the cert-manager IAM role ARN in both identity modes
 
 ## Basic Usage
 
+### IRSA (default)
+
 ```hcl
 module "cert_manager" {
   source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v5.2.0"
@@ -28,6 +30,17 @@ module "cert_manager" {
 }
 ```
 
+### EKS Pod Identity
+
+```hcl
+module "cert_manager" {
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v5.2.0"
+
+  cluster_name  = "your-cluster-name"
+  identity_mode = "pod_identity"
+}
+```
+
 ## Using Outputs
 
 ```hcl
@@ -43,69 +56,78 @@ resource "example_resource" "this" {
 ## Providers
 
 | Name | Version |
-|------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+| ---- | ------- |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.52.0 |
 
 ## Modules
 
 | Name | Source | Version |
-|------|--------|---------|
+| ---- | ------ | ------- |
 | <a name="module_nullplatform_cert_manager_role"></a> [nullplatform\_cert\_manager\_role](#module\_nullplatform\_cert\_manager\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts | n/a |
 
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
+| [aws_eks_pod_identity_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_pod_identity_association) | resource |
 | [aws_iam_policy.nullplatform_cert_manager_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [aws_iam_role.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| <a name="input_aws_iam_openid_connect_provider_arn"></a> [aws\_iam\_openid\_connect\_provider\_arn](#input\_aws\_iam\_openid\_connect\_provider\_arn) | ARN of the AWS IAM OIDC provider for EKS service account authentication | `string` | n/a | yes |
+| ---- | ----------- | ---- | ------- | :------: |
+| <a name="input_aws_iam_openid_connect_provider_arn"></a> [aws\_iam\_openid\_connect\_provider\_arn](#input\_aws\_iam\_openid\_connect\_provider\_arn) | ARN of the AWS IAM OIDC provider. Required when identity\_mode is 'irsa'; ignored when identity\_mode is 'pod\_identity'. | `string` | `null` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the cluster where the policy runs | `string` | n/a | yes |
 | <a name="input_hosted_zone_private_id"></a> [hosted\_zone\_private\_id](#input\_hosted\_zone\_private\_id) | ID of the private Route53 hosted zone for DNS validation. Set to null or an empty string to omit it from the IAM policy. At least one of hosted\_zone\_public\_id or hosted\_zone\_private\_id must be provided. | `string` | `null` | no |
 | <a name="input_hosted_zone_public_id"></a> [hosted\_zone\_public\_id](#input\_hosted\_zone\_public\_id) | ID of the public Route53 hosted zone for DNS validation. Set to null or an empty string to omit it from the IAM policy. At least one of hosted\_zone\_public\_id or hosted\_zone\_private\_id must be provided. | `string` | `null` | no |
+| <a name="input_identity_mode"></a> [identity\_mode](#input\_identity\_mode) | IAM identity mode: 'irsa' uses OIDC federation via the community iam-role-for-service-accounts module; 'pod\_identity' creates a native IAM role trusted by pods.eks.amazonaws.com with an EKS Pod Identity association. Default 'irsa' is backward compatible with v4.5.x — no state changes required on upgrade. Note: switching between modes on an existing deployment replaces the IAM role; cert-manager will lose permissions during the transition until apply completes. | `string` | `"irsa"` | no |
 
 ## Outputs
 
 | Name | Description |
-|------|-------------|
+| ---- | ----------- |
 | <a name="output_nullplatform_cert_manager_role_arn"></a> [nullplatform\_cert\_manager\_role\_arn](#output\_nullplatform\_cert\_manager\_role\_arn) | ARN of the cert-manager role |
 <!-- END_TF_DOCS -->
 
 <!-- BEGIN_AI_METADATA
 {
   "name": "cert_manager",
-  "description": "Creates an IAM role and policy for cert-manager on EKS, enabling DNS01 ACME challenge validation via Route53 hosted zones using IRSA",
-  "architecture": "An aws_iam_policy is created granting Route53 permissions (GetChange, ChangeResourceRecordSets, ListResourceRecordSets, ListHostedZonesByName) scoped to the provided public and/or private hosted zone ARNs. The terraform-aws-modules/iam iam-role-for-service-accounts module creates an aws_iam_role with an OIDC trust policy bound to the cert-manager Kubernetes service account in the cert-manager namespace. The OIDC provider ARN and cluster name flow into the role naming and trust relationship, while the hosted zone IDs are dynamically filtered and converted to ARNs via a local for expression. The role ARN is exposed as an output for use by the cert-manager Helm release or Kubernetes service account annotation.",
+  "description": "Creates an IAM role and policy for cert-manager on EKS, enabling DNS01 ACME challenge validation via Route53. Supports IRSA and EKS Pod Identity via identity_mode variable.",
+  "architecture": "An aws_iam_policy is created granting Route53 permissions scoped to the provided hosted zone ARNs. The identity_mode variable selects the authentication mechanism: 'irsa' uses the terraform-aws-modules/iam community module to create a role with OIDC trust; 'pod_identity' creates a native IAM role trusted by pods.eks.amazonaws.com and an aws_eks_pod_identity_association binding it to the cert-manager service account. The role ARN is exposed as an output in both modes.",
   "features": [
-    "Creates an IAM role with OIDC trust scoped to the cert-manager Kubernetes service account via IRSA",
+    "Supports IRSA (OIDC) and EKS Pod Identity via identity_mode variable (default: irsa)",
     "Creates an IAM policy granting Route53 permissions required for DNS01 ACME challenge validation",
     "Supports both public and private Route53 hosted zones with dynamic ARN construction",
     "Enforces that at least one of public or private hosted zone IDs is provided via input validation",
     "Scopes Route53 ChangeResourceRecordSets and ListResourceRecordSets permissions to only the specified hosted zones",
-    "Outputs the cert-manager IAM role ARN for use in service account annotations or Helm chart values"
+    "Outputs the cert-manager IAM role ARN in both identity modes"
   ],
   "inputs": [
-    {
-      "name": "aws_iam_openid_connect_provider_arn",
-      "description": "ARN of the AWS IAM OIDC provider for EKS service account authentication",
-      "required": true
-    },
     {
       "name": "cluster_name",
       "description": "Name of the cluster where the policy runs",
       "required": true
     },
+    {
+      "name": "aws_iam_openid_connect_provider_arn",
+      "description": "ARN of the AWS IAM OIDC provider. Required when identity_mode is 'irsa'; ignored when identity_mode is 'pod_identity'.",
+      "required": false
+    },
+    {
+      "name": "identity_mode",
+      "description": "IAM identity mode: 'irsa' or 'pod_identity'. Default: irsa.",
+      "required": false
+    },
     {
       "name": "hosted_zone_public_id",
-      "description": "ID of the public Route53 hosted zone for DNS validation. Set to null or an empty string to omit it from the IAM policy. At least one of hosted_zone_public_id or hosted_zone_private_id must be provided.",
+      "description": "ID of the public Route53 hosted zone for DNS validation.",
       "required": false
     },
     {
       "name": "hosted_zone_private_id",
-      "description": "ID of the private Route53 hosted zone for DNS validation. Set to null or an empty string to omit it from the IAM policy. At least one of hosted_zone_public_id or hosted_zone_private_id must be provided.",
+      "description": "ID of the private Route53 hosted zone for DNS validation.",
       "required": false
     }
   ],
diff --git a/infrastructure/aws/iam/cert_manager/main.tf b/infrastructure/aws/iam/cert_manager/main.tf
index dcf04023..6eaa08d9 100644
--- a/infrastructure/aws/iam/cert_manager/main.tf
+++ b/infrastructure/aws/iam/cert_manager/main.tf
@@ -4,10 +4,15 @@ locals {
     "arn:aws:route53:::hostedzone/${id}"
     if id != null && id != ""
   ]
+
+  cert_manager_service_accounts = [
+    { namespace = "cert-manager", service_account = "cert-manager" }
+  ]
 }
 
-# Create IAM role with OIDC provider trust for Kubernetes service account
+# IRSA: OIDC federation via community module
 module "nullplatform_cert_manager_role" {
+  count           = var.identity_mode == "irsa" ? 1 : 0
   source          = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
   name            = "nullplatform-${var.cluster_name}-cert-manager-role"
   use_name_prefix = false
@@ -24,6 +29,47 @@ module "nullplatform_cert_manager_role" {
   }
 }
 
+# Pod Identity: native IAM role trusted by the EKS Pod Identity agent
+resource "aws_iam_role" "pod_identity" {
+  count = var.identity_mode == "pod_identity" ? 1 : 0
+  name  = "nullplatform-${var.cluster_name}-cert-manager-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "pods.eks.amazonaws.com" }
+      Action    = ["sts:AssumeRole", "sts:TagSession"]
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "pod_identity" {
+  count      = var.identity_mode == "pod_identity" ? 1 : 0
+  role       = one(aws_iam_role.pod_identity[*].name)
+  policy_arn = aws_iam_policy.nullplatform_cert_manager_policy.arn
+}
+
+resource "aws_eks_pod_identity_association" "this" {
+  for_each = var.identity_mode == "pod_identity" ? {
+    for sa in local.cert_manager_service_accounts :
+    "${sa.namespace}:${sa.service_account}" => sa
+  } : {}
+
+  cluster_name    = var.cluster_name
+  namespace       = each.value.namespace
+  service_account = each.value.service_account
+  role_arn        = one(aws_iam_role.pod_identity[*].arn)
+}
+
+# Backward-compat (IRSA path only): count was added to this module call in v4.6.0;
+# consumers upgrading from a prior version have state at the un-indexed address.
+# Pod Identity deployments are new in v4.6.0 and have no prior state to migrate.
+moved {
+  from = module.nullplatform_cert_manager_role
+  to   = module.nullplatform_cert_manager_role[0]
+}
+
 # Grant permissions to manage Route 53 DNS records for DNS01 challenge
 resource "aws_iam_policy" "nullplatform_cert_manager_policy" {
   name        = "nullplatform-${var.cluster_name}-cert-manager-policy"
diff --git a/infrastructure/aws/iam/cert_manager/outputs.tf b/infrastructure/aws/iam/cert_manager/outputs.tf
index b85e6f84..d74b2734 100644
--- a/infrastructure/aws/iam/cert_manager/outputs.tf
+++ b/infrastructure/aws/iam/cert_manager/outputs.tf
@@ -1,4 +1,4 @@
 output "nullplatform_cert_manager_role_arn" {
   description = "ARN of the cert-manager role"
-  value       = module.nullplatform_cert_manager_role.arn
+  value       = var.identity_mode == "irsa" ? one(module.nullplatform_cert_manager_role[*].arn) : one(aws_iam_role.pod_identity[*].arn)
 }
diff --git a/infrastructure/aws/iam/cert_manager/tests/cert_manager.tftest.hcl b/infrastructure/aws/iam/cert_manager/tests/cert_manager.tftest.hcl
index dd685904..fd651d33 100644
--- a/infrastructure/aws/iam/cert_manager/tests/cert_manager.tftest.hcl
+++ b/infrastructure/aws/iam/cert_manager/tests/cert_manager.tftest.hcl
@@ -125,3 +125,28 @@ run "rejects_when_both_zones_empty_strings" {
 
   expect_failures = [var.hosted_zone_public_id]
 }
+
+run "irsa_mode_creates_module_and_no_pod_identity_resources" {
+  command = plan
+
+  assert {
+    condition     = length(module.nullplatform_cert_manager_role) == 1
+    error_message = "IRSA mode must create exactly one module instance"
+  }
+  assert {
+    condition     = length(aws_iam_role.pod_identity) == 0
+    error_message = "IRSA mode must not create a pod_identity IAM role"
+  }
+  assert {
+    condition     = length(aws_eks_pod_identity_association.this) == 0
+    error_message = "IRSA mode must not create any Pod Identity associations"
+  }
+  assert {
+    condition     = length(aws_iam_role_policy_attachment.pod_identity) == 0
+    error_message = "IRSA mode must not create a pod_identity policy attachment"
+  }
+  assert {
+    condition     = output.nullplatform_cert_manager_role_arn != null
+    error_message = "IRSA mode must produce a non-null role ARN output"
+  }
+}
diff --git a/infrastructure/aws/iam/cert_manager/tests/cert_manager_pod_identity.tftest.hcl b/infrastructure/aws/iam/cert_manager/tests/cert_manager_pod_identity.tftest.hcl
new file mode 100644
index 00000000..afa7e8bf
--- /dev/null
+++ b/infrastructure/aws/iam/cert_manager/tests/cert_manager_pod_identity.tftest.hcl
@@ -0,0 +1,98 @@
+mock_provider "aws" {
+  override_resource {
+    target = aws_iam_policy.nullplatform_cert_manager_policy
+    values = {
+      arn = "arn:aws:iam::123456789012:policy/nullplatform-test-cluster-cert-manager-policy"
+    }
+  }
+  override_resource {
+    target = aws_iam_role.pod_identity
+    values = {
+      arn = "arn:aws:iam::123456789012:role/nullplatform-test-cluster-cert-manager-role"
+    }
+  }
+}
+
+variables {
+  cluster_name           = "test-cluster"
+  hosted_zone_private_id = "Z0987654321DEF"
+  identity_mode          = "pod_identity"
+}
+
+run "creates_pod_identity_role" {
+  command = plan
+
+  assert {
+    condition     = length(aws_iam_role.pod_identity) == 1
+    error_message = "Pod Identity mode should create exactly one native IAM role"
+  }
+  assert {
+    condition     = strcontains(aws_iam_role.pod_identity[0].assume_role_policy, "pods.eks.amazonaws.com")
+    error_message = "Pod Identity role trust must use the pods.eks.amazonaws.com principal"
+  }
+  assert {
+    condition     = strcontains(aws_iam_role.pod_identity[0].assume_role_policy, "sts:TagSession")
+    error_message = "Pod Identity role trust must allow sts:TagSession"
+  }
+  assert {
+    condition     = length(aws_iam_role_policy_attachment.pod_identity) == 1
+    error_message = "Pod Identity mode must create exactly one policy attachment"
+  }
+  assert {
+    condition     = aws_iam_role_policy_attachment.pod_identity[0].role == "nullplatform-test-cluster-cert-manager-role"
+    error_message = "Policy attachment must reference the Pod Identity role"
+  }
+}
+
+run "creates_single_association" {
+  command = plan
+
+  assert {
+    condition     = length(aws_eks_pod_identity_association.this) == 1
+    error_message = "cert-manager should create exactly one Pod Identity association"
+  }
+  assert {
+    condition     = aws_eks_pod_identity_association.this["cert-manager:cert-manager"].service_account == "cert-manager"
+    error_message = "Association must target the cert-manager service account"
+  }
+  assert {
+    condition     = aws_eks_pod_identity_association.this["cert-manager:cert-manager"].namespace == "cert-manager"
+    error_message = "Association must target the cert-manager namespace"
+  }
+}
+
+run "pod_identity_mode_does_not_create_irsa_module" {
+  command = plan
+
+  assert {
+    condition     = length(module.nullplatform_cert_manager_role) == 0
+    error_message = "pod_identity mode must not instantiate the IRSA community module"
+  }
+  assert {
+    condition     = output.nullplatform_cert_manager_role_arn == "arn:aws:iam::123456789012:role/nullplatform-test-cluster-cert-manager-role"
+    error_message = "pod_identity mode must output the Pod Identity role ARN"
+  }
+}
+
+run "pod_identity_does_not_require_oidc_arn" {
+  command = plan
+
+  variables {
+    aws_iam_openid_connect_provider_arn = null
+  }
+
+  assert {
+    condition     = length(aws_iam_role.pod_identity) == 1
+    error_message = "Pod Identity mode must succeed without aws_iam_openid_connect_provider_arn"
+  }
+}
+
+run "rejects_invalid_identity_mode" {
+  command = plan
+
+  variables {
+    identity_mode = "wireguard"
+  }
+
+  expect_failures = [var.identity_mode]
+}
diff --git a/infrastructure/aws/iam/cert_manager/variables.tf b/infrastructure/aws/iam/cert_manager/variables.tf
index 5e73cec3..20f9de8f 100644
--- a/infrastructure/aws/iam/cert_manager/variables.tf
+++ b/infrastructure/aws/iam/cert_manager/variables.tf
@@ -19,11 +19,28 @@ variable "hosted_zone_private_id" {
 }
 
 variable "aws_iam_openid_connect_provider_arn" {
-  description = "ARN of the AWS IAM OIDC provider for EKS service account authentication"
+  description = "ARN of the AWS IAM OIDC provider. Required when identity_mode is 'irsa'; ignored when identity_mode is 'pod_identity'."
   type        = string
+  default     = null
+
+  validation {
+    condition     = var.identity_mode != "irsa" || (var.aws_iam_openid_connect_provider_arn != null && var.aws_iam_openid_connect_provider_arn != "")
+    error_message = "aws_iam_openid_connect_provider_arn is required when identity_mode is 'irsa'."
+  }
 }
 
 variable "cluster_name" {
   description = "Name of the cluster where the policy runs"
   type        = string
 }
+
+variable "identity_mode" {
+  description = "IAM identity mode: 'irsa' uses OIDC federation via the community iam-role-for-service-accounts module; 'pod_identity' creates a native IAM role trusted by pods.eks.amazonaws.com with an EKS Pod Identity association. Default 'irsa' is backward compatible with v4.5.x — no state changes required on upgrade. Note: switching between modes on an existing deployment replaces the IAM role; cert-manager will lose permissions during the transition until apply completes."
+  type        = string
+  default     = "irsa"
+
+  validation {
+    condition     = contains(["irsa", "pod_identity"], var.identity_mode)
+    error_message = "identity_mode must be either 'irsa' or 'pod_identity'."
+  }
+}
diff --git a/infrastructure/aws/iam/external_dns/.terraform.lock.hcl b/infrastructure/aws/iam/external_dns/.terraform.lock.hcl
new file mode 100644
index 00000000..821b0484
--- /dev/null
+++ b/infrastructure/aws/iam/external_dns/.terraform.lock.hcl
@@ -0,0 +1,25 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/aws" {
+  version     = "6.52.0"
+  constraints = ">= 6.28.0"
+  hashes = [
+    "h1:8H3TGxUyZ83L8spIqyrPez0BqCUAlZEd+7Y7O60/xOk=",
+    "zh:0ad03e39cef9ca83c7663efcf618eb49dd72e5930406311ec063595551e1afab",
+    "zh:24f831fa500a7778ffcb7d770250bb20caa0c86506651ed7b4ce82bf4743edfc",
+    "zh:270188d0e43e14ed74cce315e73ade0afd1bda36a5d3626270109529614f4d9e",
+    "zh:387154e5bdb49a825739414a7b859865d10411677ef9eb3f8c082709a91ac2e8",
+    "zh:3d458b379c48d67dfd50188df05f9477c752ed0913c52d342f3d311e51980d05",
+    "zh:40f5d2056829d48080abc1081cf1747724bacdc86764a5ee02422734adb15e08",
+    "zh:57837cc69ad9c1959186150b3705ca1f34e6542e8f05ae106eb747577617d8b3",
+    "zh:81d3e77d89c8819a4ceaa94b6200679a4e4d2d682c6204003a2a18d0fd587761",
+    "zh:8823b3663c5b4ec5c3bb18ccacd6aa919c52dfa876cc850afc25c4f1fdf453bc",
+    "zh:8999caef5b21d7794a216dd43265a851b098dd73e11a62022ceb2ecb8b89f172",
+    "zh:915621a7335e9d351a62a6ffabf396df98b4f116fb12a31bf4c6747e1ecc7e55",
+    "zh:9f7264c34db8d6a00bacb0119bd284f18c43a4617427703650719be25fae4b2d",
+    "zh:ba466658cf7e5549582b0eb8ed8ddce52b2ecdd5b31da94849f66cc8fa1f18e1",
+    "zh:befccb34cb734687e95211606931c09a24f403bb634087743cf75f058c944200",
+    "zh:fa749a6535df4020d90a4767fee943fdd9c606938ce4f4e1136e8ae6ba437a85",
+  ]
+}
diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md
index 8fe3c7dc..1d0cba98 100644
--- a/infrastructure/aws/iam/external_dns/README.md
+++ b/infrastructure/aws/iam/external_dns/README.md
@@ -2,23 +2,25 @@
 
 ## Description
 
-Creates an IAM role and policy for ExternalDNS on EKS, enabling Kubernetes service accounts to manage Route53 DNS records via IRSA
+Creates an IAM role and policy for ExternalDNS on EKS, enabling Kubernetes service accounts to manage Route53 DNS records. Supports both IRSA (OIDC federation) and EKS Pod Identity as the identity mechanism.
 
 ## Architecture
 
-The module creates an aws_iam_policy granting Route53 permissions scoped to the provided hosted zone ARNs, dynamically built from optional public and private zone IDs. A community iam-role-for-service-accounts module creates an aws_iam_role with an OIDC trust policy referencing the provided aws_iam_openid_connect_provider_arn, binding it to the external-dns Kubernetes service accounts in the external-dns namespace. The custom aws_iam_policy is attached to the role, and the role ARN is exposed as an output for use by the ExternalDNS deployment.
+The module creates an aws_iam_policy granting Route53 permissions scoped to the provided hosted zone ARNs, dynamically built from optional public and private zone IDs. The `identity_mode` variable selects the authentication mechanism: in `irsa` mode a community iam-role-for-service-accounts module creates an aws_iam_role with OIDC trust; in `pod_identity` mode a native aws_iam_role is created with trust for `pods.eks.amazonaws.com` and two `aws_eks_pod_identity_association` resources bind it to the `external-dns-private` and `external-dns-public` service accounts. The role ARN is exposed as an output in both modes.
 
 ## Features
 
-- Creates an aws_iam_role with OIDC provider trust for Kubernetes service accounts using IRSA
-- Creates an aws_iam_policy scoped to specific Route53 hosted zone ARNs for least-privilege DNS management
+- Supports IRSA (OIDC) and EKS Pod Identity via `identity_mode` variable (default: `irsa`)
+- Creates an IAM policy scoped to specific Route53 hosted zone ARNs for least-privilege DNS management
 - Supports both public and private Route53 hosted zones with dynamic ARN construction
 - Binds IAM role to both external-dns-private and external-dns-public Kubernetes service accounts
 - Grants route53:ChangeResourceRecordSets and listing permissions for automated DNS record management
-- Outputs the IAM role ARN for use in ExternalDNS Helm chart or Kubernetes manifests
+- Outputs the IAM role ARN in both identity modes
 
 ## Basic Usage
 
+### IRSA (default)
+
 ```hcl
 module "external_dns" {
   source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v5.2.0"
@@ -28,6 +30,17 @@ module "external_dns" {
 }
 ```
 
+### EKS Pod Identity
+
+```hcl
+module "external_dns" {
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v5.2.0"
+
+  cluster_name  = "your-cluster-name"
+  identity_mode = "pod_identity"
+}
+```
+
 ## Using Outputs
 
 ```hcl
@@ -43,69 +56,78 @@ resource "example_resource" "this" {
 ## Providers
 
 | Name | Version |
-|------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+| ---- | ------- |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.52.0 |
 
 ## Modules
 
 | Name | Source | Version |
-|------|--------|---------|
+| ---- | ------ | ------- |
 | <a name="module_nullplatform_external_dns_role"></a> [nullplatform\_external\_dns\_role](#module\_nullplatform\_external\_dns\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts | n/a |
 
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
+| [aws_eks_pod_identity_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_pod_identity_association) | resource |
 | [aws_iam_policy.nullplatform_external_dns_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [aws_iam_role.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| <a name="input_aws_iam_openid_connect_provider_arn"></a> [aws\_iam\_openid\_connect\_provider\_arn](#input\_aws\_iam\_openid\_connect\_provider\_arn) | ARN of the AWS IAM OIDC provider for EKS service account authentication | `string` | n/a | yes |
+| ---- | ----------- | ---- | ------- | :------: |
+| <a name="input_aws_iam_openid_connect_provider_arn"></a> [aws\_iam\_openid\_connect\_provider\_arn](#input\_aws\_iam\_openid\_connect\_provider\_arn) | ARN of the AWS IAM OIDC provider. Required when identity\_mode is 'irsa'; ignored when identity\_mode is 'pod\_identity'. | `string` | `null` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the cluster where the policy runs | `string` | n/a | yes |
 | <a name="input_hosted_zone_private_id"></a> [hosted\_zone\_private\_id](#input\_hosted\_zone\_private\_id) | ID of the private Route53 hosted zone for DNS management. Set to null or an empty string to omit it from the IAM policy. At least one of hosted\_zone\_public\_id or hosted\_zone\_private\_id must be provided. | `string` | `null` | no |
 | <a name="input_hosted_zone_public_id"></a> [hosted\_zone\_public\_id](#input\_hosted\_zone\_public\_id) | ID of the public Route53 hosted zone for DNS management. Set to null or an empty string to omit it from the IAM policy. At least one of hosted\_zone\_public\_id or hosted\_zone\_private\_id must be provided. | `string` | `null` | no |
+| <a name="input_identity_mode"></a> [identity\_mode](#input\_identity\_mode) | IAM identity mode: 'irsa' uses OIDC federation via the community iam-role-for-service-accounts module; 'pod\_identity' creates a native IAM role trusted by pods.eks.amazonaws.com with EKS Pod Identity associations. Default 'irsa' is backward compatible with v4.5.x — no state changes required on upgrade. Note: switching between modes on an existing deployment replaces the IAM role; external-dns will lose permissions during the transition until apply completes. | `string` | `"irsa"` | no |
 
 ## Outputs
 
 | Name | Description |
-|------|-------------|
+| ---- | ----------- |
 | <a name="output_nullplatform_external_dns_role_arn"></a> [nullplatform\_external\_dns\_role\_arn](#output\_nullplatform\_external\_dns\_role\_arn) | ARN of the external-dns role |
 <!-- END_TF_DOCS -->
 
 <!-- BEGIN_AI_METADATA
 {
   "name": "external_dns",
-  "description": "Creates an IAM role and policy for ExternalDNS on EKS, enabling Kubernetes service accounts to manage Route53 DNS records via IRSA",
-  "architecture": "The module creates an aws_iam_policy granting Route53 permissions scoped to the provided hosted zone ARNs, dynamically built from optional public and private zone IDs. A community iam-role-for-service-accounts module creates an aws_iam_role with an OIDC trust policy referencing the provided aws_iam_openid_connect_provider_arn, binding it to the external-dns Kubernetes service accounts in the external-dns namespace. The custom aws_iam_policy is attached to the role, and the role ARN is exposed as an output for use by the ExternalDNS deployment.",
+  "description": "Creates an IAM role and policy for ExternalDNS on EKS, enabling Route53 DNS management. Supports IRSA and EKS Pod Identity via identity_mode variable.",
+  "architecture": "The module creates an aws_iam_policy granting Route53 permissions scoped to the provided hosted zone ARNs. The identity_mode variable selects the authentication mechanism: 'irsa' uses the community iam-role-for-service-accounts module with OIDC trust; 'pod_identity' creates a native IAM role trusted by pods.eks.amazonaws.com and two aws_eks_pod_identity_association resources binding it to external-dns-private and external-dns-public service accounts. The role ARN is exposed as an output in both modes.",
   "features": [
-    "Creates an aws_iam_role with OIDC provider trust for Kubernetes service accounts using IRSA",
-    "Creates an aws_iam_policy scoped to specific Route53 hosted zone ARNs for least-privilege DNS management",
+    "Supports IRSA (OIDC) and EKS Pod Identity via identity_mode variable (default: irsa)",
+    "Creates an IAM policy scoped to specific Route53 hosted zone ARNs for least-privilege DNS management",
     "Supports both public and private Route53 hosted zones with dynamic ARN construction",
     "Binds IAM role to both external-dns-private and external-dns-public Kubernetes service accounts",
     "Grants route53:ChangeResourceRecordSets and listing permissions for automated DNS record management",
-    "Outputs the IAM role ARN for use in ExternalDNS Helm chart or Kubernetes manifests"
+    "Outputs the IAM role ARN in both identity modes"
   ],
   "inputs": [
-    {
-      "name": "aws_iam_openid_connect_provider_arn",
-      "description": "ARN of the AWS IAM OIDC provider for EKS service account authentication",
-      "required": true
-    },
     {
       "name": "cluster_name",
       "description": "Name of the cluster where the policy runs",
       "required": true
     },
+    {
+      "name": "aws_iam_openid_connect_provider_arn",
+      "description": "ARN of the AWS IAM OIDC provider. Required when identity_mode is 'irsa'; ignored when identity_mode is 'pod_identity'.",
+      "required": false
+    },
+    {
+      "name": "identity_mode",
+      "description": "IAM identity mode: 'irsa' or 'pod_identity'. Default: irsa.",
+      "required": false
+    },
     {
       "name": "hosted_zone_public_id",
-      "description": "ID of the public Route53 hosted zone for DNS management. Set to null or an empty string to omit it from the IAM policy. At least one of hosted_zone_public_id or hosted_zone_private_id must be provided.",
+      "description": "ID of the public Route53 hosted zone for DNS management.",
       "required": false
     },
     {
       "name": "hosted_zone_private_id",
-      "description": "ID of the private Route53 hosted zone for DNS management. Set to null or an empty string to omit it from the IAM policy. At least one of hosted_zone_public_id or hosted_zone_private_id must be provided.",
+      "description": "ID of the private Route53 hosted zone for DNS management.",
       "required": false
     }
   ],
diff --git a/infrastructure/aws/iam/external_dns/main.tf b/infrastructure/aws/iam/external_dns/main.tf
index 945bf7d7..864f1b87 100644
--- a/infrastructure/aws/iam/external_dns/main.tf
+++ b/infrastructure/aws/iam/external_dns/main.tf
@@ -4,10 +4,16 @@ locals {
     "arn:aws:route53:::hostedzone/${id}"
     if id != null && id != ""
   ]
+
+  external_dns_service_accounts = [
+    { namespace = "external-dns", service_account = "external-dns-private" },
+    { namespace = "external-dns", service_account = "external-dns-public" },
+  ]
 }
 
-# Create IAM role with OIDC provider trust for Kubernetes service account
+# IRSA: OIDC federation via community module
 module "nullplatform_external_dns_role" {
+  count           = var.identity_mode == "irsa" ? 1 : 0
   source          = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
   name            = "nullplatform-${var.cluster_name}-external-dns-role"
   use_name_prefix = false
@@ -27,6 +33,47 @@ module "nullplatform_external_dns_role" {
   }
 }
 
+# Pod Identity: native IAM role trusted by the EKS Pod Identity agent
+resource "aws_iam_role" "pod_identity" {
+  count = var.identity_mode == "pod_identity" ? 1 : 0
+  name  = "nullplatform-${var.cluster_name}-external-dns-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "pods.eks.amazonaws.com" }
+      Action    = ["sts:AssumeRole", "sts:TagSession"]
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "pod_identity" {
+  count      = var.identity_mode == "pod_identity" ? 1 : 0
+  role       = one(aws_iam_role.pod_identity[*].name)
+  policy_arn = aws_iam_policy.nullplatform_external_dns_policy.arn
+}
+
+resource "aws_eks_pod_identity_association" "this" {
+  for_each = var.identity_mode == "pod_identity" ? {
+    for sa in local.external_dns_service_accounts :
+    "${sa.namespace}:${sa.service_account}" => sa
+  } : {}
+
+  cluster_name    = var.cluster_name
+  namespace       = each.value.namespace
+  service_account = each.value.service_account
+  role_arn        = one(aws_iam_role.pod_identity[*].arn)
+}
+
+# Backward-compat (IRSA path only): count was added to this module call in v4.6.0;
+# consumers upgrading from a prior version have state at the un-indexed address.
+# Pod Identity deployments are new in v4.6.0 and have no prior state to migrate.
+moved {
+  from = module.nullplatform_external_dns_role
+  to   = module.nullplatform_external_dns_role[0]
+}
+
 # Grant permissions to manage Route 53 DNS records for service discovery
 resource "aws_iam_policy" "nullplatform_external_dns_policy" {
   name        = "nullplatform-${var.cluster_name}-external-dns-policy"
diff --git a/infrastructure/aws/iam/external_dns/outputs.tf b/infrastructure/aws/iam/external_dns/outputs.tf
index 58be7ce7..3efc0673 100644
--- a/infrastructure/aws/iam/external_dns/outputs.tf
+++ b/infrastructure/aws/iam/external_dns/outputs.tf
@@ -1,4 +1,4 @@
 output "nullplatform_external_dns_role_arn" {
   description = "ARN of the external-dns role"
-  value       = module.nullplatform_external_dns_role.arn
+  value       = var.identity_mode == "irsa" ? one(module.nullplatform_external_dns_role[*].arn) : one(aws_iam_role.pod_identity[*].arn)
 }
diff --git a/infrastructure/aws/iam/external_dns/tests/external_dns.tftest.hcl b/infrastructure/aws/iam/external_dns/tests/external_dns.tftest.hcl
index 5ef31334..c4763b55 100644
--- a/infrastructure/aws/iam/external_dns/tests/external_dns.tftest.hcl
+++ b/infrastructure/aws/iam/external_dns/tests/external_dns.tftest.hcl
@@ -125,3 +125,28 @@ run "rejects_when_both_zones_empty_strings" {
 
   expect_failures = [var.hosted_zone_public_id]
 }
+
+run "irsa_mode_creates_module_and_no_pod_identity_resources" {
+  command = plan
+
+  assert {
+    condition     = length(module.nullplatform_external_dns_role) == 1
+    error_message = "IRSA mode must create exactly one module instance"
+  }
+  assert {
+    condition     = length(aws_iam_role.pod_identity) == 0
+    error_message = "IRSA mode must not create a pod_identity IAM role"
+  }
+  assert {
+    condition     = length(aws_eks_pod_identity_association.this) == 0
+    error_message = "IRSA mode must not create any Pod Identity associations"
+  }
+  assert {
+    condition     = length(aws_iam_role_policy_attachment.pod_identity) == 0
+    error_message = "IRSA mode must not create a pod_identity policy attachment"
+  }
+  assert {
+    condition     = output.nullplatform_external_dns_role_arn != null
+    error_message = "IRSA mode must produce a non-null role ARN output"
+  }
+}
diff --git a/infrastructure/aws/iam/external_dns/tests/external_dns_pod_identity.tftest.hcl b/infrastructure/aws/iam/external_dns/tests/external_dns_pod_identity.tftest.hcl
new file mode 100644
index 00000000..06cd5bd5
--- /dev/null
+++ b/infrastructure/aws/iam/external_dns/tests/external_dns_pod_identity.tftest.hcl
@@ -0,0 +1,106 @@
+mock_provider "aws" {
+  override_resource {
+    target = aws_iam_policy.nullplatform_external_dns_policy
+    values = {
+      arn = "arn:aws:iam::123456789012:policy/nullplatform-test-cluster-external-dns-policy"
+    }
+  }
+  override_resource {
+    target = aws_iam_role.pod_identity
+    values = {
+      arn = "arn:aws:iam::123456789012:role/nullplatform-test-cluster-external-dns-role"
+    }
+  }
+}
+
+variables {
+  cluster_name           = "test-cluster"
+  hosted_zone_private_id = "Z0987654321DEF"
+  identity_mode          = "pod_identity"
+}
+
+run "creates_pod_identity_role" {
+  command = plan
+
+  assert {
+    condition     = length(aws_iam_role.pod_identity) == 1
+    error_message = "Pod Identity mode should create exactly one native IAM role"
+  }
+  assert {
+    condition     = strcontains(aws_iam_role.pod_identity[0].assume_role_policy, "pods.eks.amazonaws.com")
+    error_message = "Pod Identity role trust must use the pods.eks.amazonaws.com principal"
+  }
+  assert {
+    condition     = strcontains(aws_iam_role.pod_identity[0].assume_role_policy, "sts:TagSession")
+    error_message = "Pod Identity role trust must allow sts:TagSession"
+  }
+  assert {
+    condition     = length(aws_iam_role_policy_attachment.pod_identity) == 1
+    error_message = "Pod Identity mode must create exactly one policy attachment"
+  }
+  assert {
+    condition     = aws_iam_role_policy_attachment.pod_identity[0].role == "nullplatform-test-cluster-external-dns-role"
+    error_message = "Policy attachment must reference the Pod Identity role"
+  }
+}
+
+run "creates_two_associations" {
+  command = plan
+
+  assert {
+    condition     = length(aws_eks_pod_identity_association.this) == 2
+    error_message = "external-dns should create two Pod Identity associations (private + public)"
+  }
+  assert {
+    condition     = aws_eks_pod_identity_association.this["external-dns:external-dns-private"].service_account == "external-dns-private"
+    error_message = "Association must target the external-dns-private service account"
+  }
+  assert {
+    condition     = aws_eks_pod_identity_association.this["external-dns:external-dns-public"].service_account == "external-dns-public"
+    error_message = "Association must target the external-dns-public service account"
+  }
+  assert {
+    condition     = aws_eks_pod_identity_association.this["external-dns:external-dns-private"].namespace == "external-dns"
+    error_message = "Associations must target the external-dns namespace"
+  }
+  assert {
+    condition     = aws_eks_pod_identity_association.this["external-dns:external-dns-public"].namespace == "external-dns"
+    error_message = "Associations must target the external-dns namespace"
+  }
+}
+
+run "pod_identity_mode_does_not_create_irsa_module" {
+  command = plan
+
+  assert {
+    condition     = length(module.nullplatform_external_dns_role) == 0
+    error_message = "pod_identity mode must not instantiate the IRSA community module"
+  }
+  assert {
+    condition     = output.nullplatform_external_dns_role_arn == "arn:aws:iam::123456789012:role/nullplatform-test-cluster-external-dns-role"
+    error_message = "pod_identity mode must output the Pod Identity role ARN"
+  }
+}
+
+run "pod_identity_does_not_require_oidc_arn" {
+  command = plan
+
+  variables {
+    aws_iam_openid_connect_provider_arn = null
+  }
+
+  assert {
+    condition     = length(aws_iam_role.pod_identity) == 1
+    error_message = "Pod Identity mode must succeed without aws_iam_openid_connect_provider_arn"
+  }
+}
+
+run "rejects_invalid_identity_mode" {
+  command = plan
+
+  variables {
+    identity_mode = "wireguard"
+  }
+
+  expect_failures = [var.identity_mode]
+}
diff --git a/infrastructure/aws/iam/external_dns/variables.tf b/infrastructure/aws/iam/external_dns/variables.tf
index 0510cb75..63aed83c 100644
--- a/infrastructure/aws/iam/external_dns/variables.tf
+++ b/infrastructure/aws/iam/external_dns/variables.tf
@@ -19,11 +19,28 @@ variable "hosted_zone_private_id" {
 }
 
 variable "aws_iam_openid_connect_provider_arn" {
-  description = "ARN of the AWS IAM OIDC provider for EKS service account authentication"
+  description = "ARN of the AWS IAM OIDC provider. Required when identity_mode is 'irsa'; ignored when identity_mode is 'pod_identity'."
   type        = string
+  default     = null
+
+  validation {
+    condition     = var.identity_mode != "irsa" || (var.aws_iam_openid_connect_provider_arn != null && var.aws_iam_openid_connect_provider_arn != "")
+    error_message = "aws_iam_openid_connect_provider_arn is required when identity_mode is 'irsa'."
+  }
 }
 
 variable "cluster_name" {
   description = "Name of the cluster where the policy runs"
   type        = string
 }
+
+variable "identity_mode" {
+  description = "IAM identity mode: 'irsa' uses OIDC federation via the community iam-role-for-service-accounts module; 'pod_identity' creates a native IAM role trusted by pods.eks.amazonaws.com with EKS Pod Identity associations. Default 'irsa' is backward compatible with v4.5.x — no state changes required on upgrade. Note: switching between modes on an existing deployment replaces the IAM role; external-dns will lose permissions during the transition until apply completes."
+  type        = string
+  default     = "irsa"
+
+  validation {
+    condition     = contains(["irsa", "pod_identity"], var.identity_mode)
+    error_message = "identity_mode must be either 'irsa' or 'pod_identity'."
+  }
+}
diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md
index a4126806..a214b4c1 100644
--- a/infrastructure/commons/cert_manager/README.md
+++ b/infrastructure/commons/cert_manager/README.md
@@ -6,13 +6,13 @@ Deploys cert-manager and its cloud-provider-specific configuration onto a Kubern
 
 ## Architecture
 
-The module creates two core helm_release resources: cert-manager from the Jetstack chart repository and nullplatform-cert-manager-config from the nullplatform Helm chart repository, with the config release depending on the cert-manager release. A third conditional helm_release resource for cert-manager-webhook-oci is created only when cloud_provider is set to 'oci'. Provider-specific service account annotations (such as GKE Workload Identity email, EKS IRSA role ARN, Azure Workload Identity client ID, or OCI workload identity OCID) are merged into the cert-manager serviceAccount resource via locals, and provider-specific solver values are rendered from per-provider template files and passed as Helm values to the config chart.
+The module creates two core helm_release resources: cert-manager from the Jetstack chart repository and nullplatform-cert-manager-config from the nullplatform Helm chart repository, with the config release depending on the cert-manager release. A third conditional helm_release resource for cert-manager-webhook-oci is created only when cloud_provider is set to 'oci'. Provider-specific service account annotations are merged into the cert-manager serviceAccount resource via locals (GKE Workload Identity email, EKS IRSA role ARN when `aws_identity_mode=irsa`, Azure Workload Identity client ID, OCI workload identity OCID). When `aws_identity_mode=pod_identity` the IRSA annotation is omitted and EKS Pod Identity injects credentials via the agent. Provider-specific solver values are rendered from per-provider template files and passed as Helm values to the config chart.
 
 ## Features
 
 - Deploys cert-manager Helm chart with CRDs enabled and DNS01 recursive nameservers configured
 - Renders provider-specific cert-manager-config Helm values from templatefiles for each supported cloud provider
-- Configures cert-manager Kubernetes ServiceAccount annotations with cloud-provider IAM identity bindings (GKE Workload Identity, EKS IRSA, Azure Workload Identity, OCI Workload Identity)
+- Configures cert-manager Kubernetes ServiceAccount annotations with cloud-provider IAM identity bindings (GKE Workload Identity, EKS IRSA or Pod Identity via `aws_identity_mode`, Azure Workload Identity, OCI Workload Identity)
 - Deploys cert-manager-webhook-oci Helm chart conditionally when OCI is the selected cloud provider
 - Supports Azure Service Principal authentication as fallback when Workload Identity is disabled
 - Merges base Helm chart version annotations with provider-specific pod and service account annotations using locals
@@ -122,20 +122,20 @@ resource "example_resource" "this" {
 ## Requirements
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | ~> 3.0 |
 
 ## Providers
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 3.1.1 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [helm_release.cert_manager](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.cert_manager_config](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.cert_manager_webhook_oci](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
@@ -144,8 +144,9 @@ resource "example_resource" "this" {
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_account_slug"></a> [account\_slug](#input\_account\_slug) | The nullplatform account slug. | `string` | n/a | yes |
+| <a name="input_aws_identity_mode"></a> [aws\_identity\_mode](#input\_aws\_identity\_mode) | AWS identity mechanism for the cert-manager service account: "irsa" sets the eks.amazonaws.com/role-arn annotation; "pod\_identity" omits it (EKS Pod Identity injects credentials via the Pod Identity agent). | `string` | `"irsa"` | no |
 | <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | The AWS region. | `string` | `""` | no |
 | <a name="input_aws_sa_arn"></a> [aws\_sa\_arn](#input\_aws\_sa\_arn) | The AWS IAM role ARN for cert-manager. | `string` | `""` | no |
 | <a name="input_azure_client_id"></a> [azure\_client\_id](#input\_azure\_client\_id) | The Azure client ID for cert-manager. | `string` | `""` | no |
diff --git a/infrastructure/commons/cert_manager/locals.tf b/infrastructure/commons/cert_manager/locals.tf
index 8fcbd0c8..bb7bd4c3 100644
--- a/infrastructure/commons/cert_manager/locals.tf
+++ b/infrastructure/commons/cert_manager/locals.tf
@@ -65,9 +65,9 @@ locals {
       "iam.gke.io/gcp-service-account" = var.gcp_sa_email
     }
 
-    aws = {
+    aws = var.aws_identity_mode == "irsa" ? {
       "eks.amazonaws.com/role-arn" = var.aws_sa_arn
-    }
+    } : {}
 
     azure = var.azure_workload_identity_enabled ? {
       "azure.workload.identity/client-id" = var.azure_client_id
diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl
index 6a3f5bd8..d7b52522 100644
--- a/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl
+++ b/infrastructure/commons/cert_manager/tests/cert_manager_aws.tftest.hcl
@@ -65,3 +65,38 @@ run "aws_requires_region" {
 
   expect_failures = [terraform_data.provider_validation]
 }
+
+# Validates Pod Identity mode omits the IRSA role-arn annotation
+run "aws_pod_identity_omits_role_annotation" {
+  command = plan
+
+  variables {
+    aws_identity_mode = "pod_identity"
+  }
+
+  assert {
+    condition     = !contains(keys(local.annotations_by_provider["aws"]), "eks.amazonaws.com/role-arn")
+    error_message = "Pod Identity mode must omit the IRSA role-arn annotation"
+  }
+}
+
+# Validates IRSA mode (default) keeps the role-arn annotation
+run "aws_irsa_keeps_role_annotation" {
+  command = plan
+
+  assert {
+    condition     = local.annotations_by_provider["aws"]["eks.amazonaws.com/role-arn"] == "arn:aws:iam::123456789012:role/cert-manager"
+    error_message = "IRSA mode (default) must keep the role-arn annotation"
+  }
+}
+
+# Validates invalid aws_identity_mode is rejected
+run "rejects_invalid_aws_identity_mode" {
+  command = plan
+
+  variables {
+    aws_identity_mode = "wireguard"
+  }
+
+  expect_failures = [var.aws_identity_mode]
+}
diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl
index 595e2f0c..479a3c76 100644
--- a/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl
+++ b/infrastructure/commons/cert_manager/tests/cert_manager_azure.tftest.hcl
@@ -1,10 +1,10 @@
 mock_provider "helm" {}
 
 variables {
-  cloud_provider            = "azure"
-  hosted_zone_name          = "myorg.nullimplementation.com"
-  account_slug              = "myorg"
-  private_domain_name       = "myorg.nullimplementation.com"
+  cloud_provider                = "azure"
+  hosted_zone_name              = "myorg.nullimplementation.com"
+  account_slug                  = "myorg"
+  private_domain_name           = "myorg.nullimplementation.com"
   azure_client_id               = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
   azure_federated_credential_id = "/subscriptions/00000000/resourceGroups/rg-test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/cert-manager/federatedIdentityCredentials/cert-manager-federated"
   azure_subscription_id         = "00000000-0000-0000-0000-000000000000"
diff --git a/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl b/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl
index e34b0ae7..89b0334d 100644
--- a/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl
+++ b/infrastructure/commons/cert_manager/tests/cert_manager_cross_provider.tftest.hcl
@@ -19,10 +19,10 @@ run "gcp_vars_not_required_for_azure" {
   command = plan
 
   variables {
-    cloud_provider            = "azure"
-    hosted_zone_name          = "myorg.example.com"
-    account_slug              = "myorg"
-    private_domain_name       = "myorg.example.com"
+    cloud_provider                = "azure"
+    hosted_zone_name              = "myorg.example.com"
+    account_slug                  = "myorg"
+    private_domain_name           = "myorg.example.com"
     azure_client_id               = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
     azure_federated_credential_id = "/subscriptions/00000000/resourceGroups/rg-test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/cert-manager/federatedIdentityCredentials/cert-manager-federated"
     azure_subscription_id         = "00000000-0000-0000-0000-000000000000"
@@ -123,10 +123,10 @@ run "oci_webhook_not_deployed_for_azure" {
   command = plan
 
   variables {
-    cloud_provider            = "azure"
-    hosted_zone_name          = "myorg.example.com"
-    account_slug              = "myorg"
-    private_domain_name       = "myorg.example.com"
+    cloud_provider                = "azure"
+    hosted_zone_name              = "myorg.example.com"
+    account_slug                  = "myorg"
+    private_domain_name           = "myorg.example.com"
     azure_client_id               = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
     azure_federated_credential_id = "/subscriptions/00000000/resourceGroups/rg-test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/cert-manager/federatedIdentityCredentials/cert-manager-federated"
     azure_subscription_id         = "00000000-0000-0000-0000-000000000000"
diff --git a/infrastructure/commons/cert_manager/variables.tf b/infrastructure/commons/cert_manager/variables.tf
index fa185408..0ed891ca 100644
--- a/infrastructure/commons/cert_manager/variables.tf
+++ b/infrastructure/commons/cert_manager/variables.tf
@@ -147,6 +147,17 @@ variable "aws_region" {
   default     = ""
 }
 
+variable "aws_identity_mode" {
+  description = "AWS identity mechanism for the cert-manager service account: \"irsa\" sets the eks.amazonaws.com/role-arn annotation; \"pod_identity\" omits it (EKS Pod Identity injects credentials via the Pod Identity agent)."
+  type        = string
+  default     = "irsa"
+
+  validation {
+    condition     = contains(["irsa", "pod_identity"], var.aws_identity_mode)
+    error_message = "aws_identity_mode must be one of: irsa, pod_identity."
+  }
+}
+
 ###############################################################################
 # OCI CONFIGURATION
 ###############################################################################
diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md
index 778394f9..b86537ad 100644
--- a/infrastructure/commons/external_dns/README.md
+++ b/infrastructure/commons/external_dns/README.md
@@ -6,14 +6,14 @@ Deploys ExternalDNS on Kubernetes via Helm with support for Cloudflare, AWS Rout
 
 ## Architecture
 
-The module creates an optional kubernetes_namespace_v1 resource and a helm_release resource that deploys the external-dns Helm chart. Provider-specific configuration is assembled in locals.tf by merging a base_config with a provider-specific config block (cloudflare_config, route53_config, oci_config, or azure_config) selected via var.dns_provider_name. Provider secrets are injected as kubernetes_secret_v1 resources (Cloudflare API token, OCI config file, Azure config file) and mounted into the ExternalDNS pod via extraVolumes and extraVolumeMounts. For AWS and OCI, IRSA or Workload Identity is wired through serviceAccount annotations; for Azure, pod labels and service account annotations are conditionally set based on azure_workload_identity_enabled.
+The module creates an optional kubernetes_namespace_v1 resource and a helm_release resource that deploys the external-dns Helm chart. Provider-specific configuration is assembled in locals.tf by merging a base_config with a provider-specific config block (cloudflare_config, route53_config, oci_config, or azure_config) selected via var.dns_provider_name. Provider secrets are injected as kubernetes_secret_v1 resources (Cloudflare API token, OCI config file, Azure config file) and mounted into the ExternalDNS pod via extraVolumes and extraVolumeMounts. For AWS, the `aws_identity_mode` variable controls whether the `eks.amazonaws.com/role-arn` SA annotation is set (`irsa`, default) or omitted (`pod_identity`, where EKS Pod Identity injects credentials via the agent). For Azure, pod labels and service account annotations are conditionally set based on `azure_workload_identity_enabled`.
 
 ## Features
 
 - Deploys ExternalDNS via helm_release with atomic, self-healing install options and configurable chart version
 - Creates kubernetes_namespace_v1 optionally to support multi-instance deployments in existing namespaces
 - Configures Cloudflare provider by injecting CF_API_TOKEN from a kubernetes_secret_v1 environment variable reference
-- Configures AWS Route53 provider with IRSA service account annotations, RBAC for DNSEndpoints and Gateway API resources, and zone/label filters
+- Configures AWS Route53 provider with IRSA or Pod Identity support via `aws_identity_mode`, RBAC for DNSEndpoints and Gateway API resources, and zone/label filters
 - Configures OCI provider with Workload Identity service account, compartment OCID, zone scope, and a mounted OCI config secret
 - Configures Azure Public and Private DNS providers with Workload Identity or Service Principal auth via a mounted azure-config secret
 - Supports public and private deployment types with label-based resource filtering for multi-instance scenarios
@@ -115,13 +115,13 @@ resource "example_resource" "this" {
 ## Requirements
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | ~> 3.0 |
 
 ## Providers
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 3.1.1 |
 | <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 3.0.1 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
@@ -129,7 +129,7 @@ resource "example_resource" "this" {
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [helm_release.external_dns](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [kubernetes_namespace_v1.external_dns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1) | resource |
 | [kubernetes_secret_v1.external_dns_azure_config](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
@@ -140,8 +140,9 @@ resource "example_resource" "this" {
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_aws_iam_role_arn"></a> [aws\_iam\_role\_arn](#input\_aws\_iam\_role\_arn) | The IAM role ARN for ExternalDNS to assume for Route53 access (required when dns\_provider\_name is 'aws') | `string` | `""` | no |
+| <a name="input_aws_identity_mode"></a> [aws\_identity\_mode](#input\_aws\_identity\_mode) | AWS identity mechanism for the external-dns service account: "irsa" sets the eks.amazonaws.com/role-arn annotation; "pod\_identity" omits it (EKS Pod Identity injects credentials via the Pod Identity agent). | `string` | `"irsa"` | no |
 | <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | The AWS region where the Route53 hosted zones are located | `string` | `""` | no |
 | <a name="input_azure_client_id"></a> [azure\_client\_id](#input\_azure\_client\_id) | Client ID of the Azure Managed Identity for Workload Identity (required when dns\_provider\_name is 'azure' and azure\_workload\_identity\_enabled is true) | `string` | `""` | no |
 | <a name="input_azure_client_secret"></a> [azure\_client\_secret](#input\_azure\_client\_secret) | Azure AD client secret for Service Principal auth (required when dns\_provider\_name is 'azure' and azure\_workload\_identity\_enabled is false). | `string` | `""` | no |
diff --git a/infrastructure/commons/external_dns/locals.tf b/infrastructure/commons/external_dns/locals.tf
index ef64203e..bcc0bb71 100644
--- a/infrastructure/commons/external_dns/locals.tf
+++ b/infrastructure/commons/external_dns/locals.tf
@@ -35,9 +35,9 @@ locals {
     }]
     serviceAccount = {
       create = true
-      annotations = {
+      annotations = var.aws_identity_mode == "irsa" ? {
         "eks.amazonaws.com/role-arn" = var.aws_iam_role_arn
-      }
+      } : {}
     }
     rbac = {
       create = true
diff --git a/infrastructure/commons/external_dns/tests/external_dns_aws.tftest.hcl b/infrastructure/commons/external_dns/tests/external_dns_aws.tftest.hcl
index d6453fc4..1ce114f2 100644
--- a/infrastructure/commons/external_dns/tests/external_dns_aws.tftest.hcl
+++ b/infrastructure/commons/external_dns/tests/external_dns_aws.tftest.hcl
@@ -1,97 +1,106 @@
-# TODO: Enable once the OCI eager evaluation bug in locals.tf is fixed.
-# locals.tf evaluates all provider configs (including OCI string interpolation)
-# regardless of which provider is selected, causing null interpolation errors.
-#
-# mock_provider "helm" {}
-# mock_provider "kubernetes" {}
-#
-# variables {
-#   dns_provider_name      = "aws"
-#   domain_filters         = "myorg.example.com"
-#   external_dns_namespace = "external-dns"
-#   aws_region             = "us-east-1"
-#   aws_iam_role_arn       = "arn:aws:iam::123456789012:role/external-dns"
-#   zone_id_filter         = "Z1234567890ABC"
-#   zone_type              = "public"
-# }
-#
-# run "aws_full_config" {
-#   command = plan
-#
-#   assert {
-#     condition     = helm_release.external_dns.name == "external-dns-public"
-#     error_message = "Helm release name should include type suffix"
-#   }
-# }
-#
-# run "aws_irsa_annotation" {
-#   command = plan
-#
-#   assert {
-#     condition     = local.route53_config.serviceAccount.annotations["eks.amazonaws.com/role-arn"] == "arn:aws:iam::123456789012:role/external-dns"
-#     error_message = "AWS IRSA annotation should match aws_iam_role_arn"
-#   }
-# }
-#
-# run "aws_zone_filtering_args" {
-#   command = plan
-#
-#   assert {
-#     condition     = contains(local.route53_config.extraArgs, "--aws-zone-type=public")
-#     error_message = "Extra args should include --aws-zone-type"
-#   }
-#
-#   assert {
-#     condition     = contains(local.route53_config.extraArgs, "--zone-id-filter=Z1234567890ABC")
-#     error_message = "Extra args should include --zone-id-filter"
-#   }
-# }
-#
-# run "no_cloudflare_secret_for_aws" {
-#   command = plan
-#
-#   assert {
-#     condition     = length(kubernetes_secret_v1.external_dns_cloudflare) == 0
-#     error_message = "Cloudflare secret should not be created for AWS provider"
-#   }
-# }
-#
-# run "aws_requires_region" {
-#   command = plan
-#
-#   variables {
-#     aws_region = null
-#   }
-#
-#   expect_failures = [var.aws_region]
-# }
-#
-# run "aws_requires_iam_role" {
-#   command = plan
-#
-#   variables {
-#     aws_iam_role_arn = null
-#   }
-#
-#   expect_failures = [var.aws_iam_role_arn]
-# }
-#
-# run "aws_requires_zone_id_filter" {
-#   command = plan
-#
-#   variables {
-#     zone_id_filter = ""
-#   }
-#
-#   expect_failures = [var.zone_id_filter]
-# }
-#
-# run "aws_rejects_invalid_zone_type" {
-#   command = plan
-#
-#   variables {
-#     zone_type = "internal"
-#   }
-#
-#   expect_failures = [var.zone_type]
-# }
+mock_provider "helm" {}
+mock_provider "kubernetes" {}
+
+variables {
+  dns_provider_name      = "aws"
+  domain_filters         = "myorg.example.com"
+  external_dns_namespace = "external-dns"
+  aws_region             = "us-east-1"
+  aws_iam_role_arn       = "arn:aws:iam::123456789012:role/external-dns"
+  zone_id_filter         = "Z1234567890ABC"
+  zone_type              = "public"
+}
+
+run "aws_full_config" {
+  command = plan
+
+  assert {
+    condition     = helm_release.external_dns.name == "external-dns-public"
+    error_message = "Helm release name should include type suffix"
+  }
+}
+
+run "aws_irsa_annotation" {
+  command = plan
+
+  assert {
+    condition     = local.route53_config.serviceAccount.annotations["eks.amazonaws.com/role-arn"] == "arn:aws:iam::123456789012:role/external-dns"
+    error_message = "AWS IRSA annotation should match aws_iam_role_arn"
+  }
+}
+
+run "aws_zone_filtering_args" {
+  command = plan
+
+  assert {
+    condition     = contains(local.route53_config.extraArgs, "--aws-zone-type=public")
+    error_message = "Extra args should include --aws-zone-type"
+  }
+
+  assert {
+    condition     = contains(local.route53_config.extraArgs, "--zone-id-filter=Z1234567890ABC")
+    error_message = "Extra args should include --zone-id-filter"
+  }
+}
+
+run "no_cloudflare_secret_for_aws" {
+  command = plan
+
+  assert {
+    condition     = length(kubernetes_secret_v1.external_dns_cloudflare) == 0
+    error_message = "Cloudflare secret should not be created for AWS provider"
+  }
+}
+
+run "aws_requires_region" {
+  command = plan
+
+  variables {
+    aws_region = ""
+  }
+
+  expect_failures = [terraform_data.provider_validation]
+}
+
+run "aws_requires_iam_role" {
+  command = plan
+
+  variables {
+    aws_iam_role_arn = ""
+  }
+
+  expect_failures = [terraform_data.provider_validation]
+}
+
+run "aws_requires_zone_id_filter" {
+  command = plan
+
+  variables {
+    zone_id_filter = ""
+  }
+
+  expect_failures = [terraform_data.provider_validation]
+}
+
+run "aws_rejects_invalid_zone_type" {
+  command = plan
+
+  variables {
+    zone_type = "internal"
+  }
+
+  expect_failures = [terraform_data.provider_validation]
+}
+
+run "aws_pod_identity_omits_role_annotation" {
+  command = plan
+
+  variables {
+    aws_identity_mode = "pod_identity"
+  }
+
+  assert {
+    condition     = !contains(keys(local.route53_config.serviceAccount.annotations), "eks.amazonaws.com/role-arn")
+    error_message = "Pod Identity mode must omit the IRSA role-arn annotation"
+  }
+}
diff --git a/infrastructure/commons/external_dns/variables.tf b/infrastructure/commons/external_dns/variables.tf
index 2eeb6fcc..919a7aee 100644
--- a/infrastructure/commons/external_dns/variables.tf
+++ b/infrastructure/commons/external_dns/variables.tf
@@ -83,24 +83,39 @@ variable "aws_region" {
   description = "The AWS region where the Route53 hosted zones are located"
   type        = string
   default     = ""
+  nullable    = false
 }
 
 variable "aws_iam_role_arn" {
   description = "The IAM role ARN for ExternalDNS to assume for Route53 access (required when dns_provider_name is 'aws')"
   type        = string
   default     = ""
+  nullable    = false
+}
+
+variable "aws_identity_mode" {
+  description = "AWS identity mechanism for the external-dns service account: \"irsa\" sets the eks.amazonaws.com/role-arn annotation; \"pod_identity\" omits it (EKS Pod Identity injects credentials via the Pod Identity agent)."
+  type        = string
+  default     = "irsa"
+
+  validation {
+    condition     = contains(["irsa", "pod_identity"], var.aws_identity_mode)
+    error_message = "aws_identity_mode must be one of: irsa, pod_identity."
+  }
 }
 
 variable "zone_id_filter" {
   description = "The Route53 public or private hosted zone ID for ExternalDNS to manage (required when dns_provider_name is 'aws')"
   type        = string
   default     = ""
+  nullable    = false
 }
 
 variable "zone_type" {
   description = "The Route53 hosted zone type for ExternalDNS to manage (public or private)"
   type        = string
   default     = ""
+  nullable    = false
 }
 
 ###############################################################################