diff --git a/roles/network_plugin/cilium/defaults/main.yml b/roles/network_plugin/cilium/defaults/main.yml
index 48e25447472..4ca4516214a 100644
--- a/roles/network_plugin/cilium/defaults/main.yml
+++ b/roles/network_plugin/cilium/defaults/main.yml
@@ -53,4 +53,8 @@ cilium_auto_direct_node_routes: false
 cilium_native_routing_cidr: ""
 
 # IPsec based transparent encryption between nodes
-cilium_ipsec_enabled: false
\ No newline at end of file
+cilium_ipsec_enabled: false
+
+# IP address management mode for v1.9+.
+# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
+cilium_ipam_mode: kubernetes
diff --git a/roles/network_plugin/cilium/templates/cilium-config.yml.j2 b/roles/network_plugin/cilium/templates/cilium-config.yml.j2
index d430fe733d4..7df18b3f241 100644
--- a/roles/network_plugin/cilium/templates/cilium-config.yml.j2
+++ b/roles/network_plugin/cilium/templates/cilium-config.yml.j2
@@ -161,4 +161,9 @@ data:
   enable-ipsec: "true"
   ipsec-key-file: /etc/ipsec/keys
   encrypt-node: "false"
-{% endif %}
\ No newline at end of file
+{% endif %}
+
+  # IPAM settings
+{% if cilium_version | regex_replace('v') is version('1.9', '>=') %}
+  ipam: "{{ cilium_ipam_mode }}"
+{% endif %}
diff --git a/roles/network_plugin/cilium/templates/cilium-deploy.yml.j2 b/roles/network_plugin/cilium/templates/cilium-deploy.yml.j2
index bf65a746d9b..baae001c0ba 100644
--- a/roles/network_plugin/cilium/templates/cilium-deploy.yml.j2
+++ b/roles/network_plugin/cilium/templates/cilium-deploy.yml.j2
@@ -44,6 +44,7 @@ spec:
       containers:
         - args:
             - --debug=$(CILIUM_DEBUG)
+            - --config-dir=/tmp/cilium/config-map
             - --kvstore=etcd
             - --kvstore-opt=etcd.config=/var/lib/etcd-config/etcd.config
           command:
@@ -142,6 +143,9 @@ spec:
             - mountPath: "{{cilium_cert_dir}}"
               name: etcd-secrets
               readOnly: true
+            - mountPath: /tmp/cilium/config-map
+              name: cilium-config-path
+              readOnly: true
       dnsPolicy: ClusterFirst
       priorityClassName: system-node-critical
       restartPolicy: Always
@@ -163,3 +167,6 @@ spec:
         - name: etcd-secrets
           hostPath:
             path: "{{cilium_cert_dir}}"
+        - configMap:
+            name: cilium-config
+          name: cilium-config-path