diff --git a/charts/internal/shoot-cert-management-seed/templates/vpa.yaml b/charts/internal/shoot-cert-management-seed/templates/vpa.yaml
index fba5e51c..8ac1c29f 100644
--- a/charts/internal/shoot-cert-management-seed/templates/vpa.yaml
+++ b/charts/internal/shoot-cert-management-seed/templates/vpa.yaml
@@ -1,4 +1,4 @@
----
+{{- if .Values.vpa.enabled }}
 apiVersion: autoscaling.k8s.io/v1
 kind: VerticalPodAutoscaler
 metadata:
@@ -10,10 +10,11 @@ spec:
     kind: Deployment
     name: {{ include "cert-management.fullname" . }}
   updatePolicy:
-    updateMode: "Auto"
+    updateMode: {{ .Values.vpa.updatePolicy.updateMode }}
   resourcePolicy:
     containerPolicies:
       - containerName: '*'
         controlledValues: RequestsOnly
         minAllowed:
-          memory: 20Mi
+          memory: {{ .Values.vpa.minAllowed.memory }}
+{{- end }}
diff --git a/charts/internal/shoot-cert-management-seed/values.yaml b/charts/internal/shoot-cert-management-seed/values.yaml
index 017185fa..2236020f 100644
--- a/charts/internal/shoot-cert-management-seed/values.yaml
+++ b/charts/internal/shoot-cert-management-seed/values.yaml
@@ -15,8 +15,8 @@ genericTokenKubeconfigSecretName: generic-token-kubeconfig
 
 resources:
   requests:
-    cpu: 100m
-    memory: 128Mi
+    cpu: 5m
+    memory: 30Mi
 
 nodeSelector: {}
 tolerations: []
@@ -85,5 +85,12 @@ additionalConfiguration:
 - --source.disable-deploy-crds
 - --target.disable-deploy-crds
 
+vpa:
+  enabled: true
+  minAllowed:
+    memory: 20Mi
+  updatePolicy:
+    updateMode: "Auto"
+
 # TODO(rfranzke): Remove this field after August 2024.
 gep19Monitoring: false