diff --git a/Chart.yaml b/Chart.yaml
index 7b14bba..e090f1f 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -7,4 +7,4 @@ keywords:
 - confidential-containers
 name: trustee
 # DO NOT EDIT VERSION HERE, IT IS AUTO-GENERATED BY SEMANTIC-RELEASE
-version: 0.8.0
+version: 0.9.0
diff --git a/README.md b/README.md
index 4510e46..aae31a7 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # trustee
 
-![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square)
+![Version: 0.9.0](https://img.shields.io/badge/Version-0.9.0-informational?style=flat-square)
 
 A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
 
@@ -31,12 +31,17 @@ In order to use this chart, you will need to:
 | global.coco.securityPolicy | string | `"secret/data/hub/securityPolicyConfig"` |  |
 | global.coco.securityPolicyFlavour | string | `"insecure"` |  |
 | global.secretStore.backend | string | `""` |  |
-| kbs.admin.format | string | `"v1.0"` |  |
+| kbs.azure.abiMajor | string | `"0"` |  |
+| kbs.azure.abiMinor | string | `"31"` |  |
+| kbs.azure.singleSocket | string | `"false"` |  |
+| kbs.azure.smtAllowed | string | `"true"` |  |
+| kbs.azure.smtEnabled | string | `"true"` |  |
+| kbs.azure.snpLaunchMeasurement | string | `"qnydpVwThuWxZTsSWXi+2ns/laha6w+d2723g84FaijJ0CHaI5w0pYw6ZXZUJw7v"` |  |
+| kbs.azure.tsmeEnabled | string | `"true"` |  |
 | kbs.baremetal.enabled | bool | `false` |  |
 | kbs.cosignKeys | string | `"secret/data/hub/coSignKeys"` |  |
 | kbs.extraSecrets[0] | string | `"credential"` |  |
 | kbs.gpu.enabled | bool | `false` |  |
-| kbs.publicKey | string | `"secret/data/hub/kbsPublicKey"` |  |
 | kbs.resourcePolicy.enforceHardware | bool | `true` |  |
 | kbs.secretResources[0].key | string | `"secret/data/hub/kbsres1"` |  |
 | kbs.secretResources[0].name | string | `"kbsres1"` |  |
diff --git a/templates/attestation-policy.yaml b/templates/attestation-policy.yaml
index abf47c5..dc0d72a 100644
--- a/templates/attestation-policy.yaml
+++ b/templates/attestation-policy.yaml
@@ -5,6 +5,7 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
   default_cpu.rego: |
     package policy
@@ -105,98 +106,74 @@ data:
 
     ##### Azure vTPM SNP
     executables := 3 if {
-      input["az_snp_vtpm"]
-
-      input["az_snp_vtpm"].measurement in query_reference_value("measurement")
-      input["az_snp_vtpm"].tpm.pcr03 in query_reference_value("snp_pcr03")
-      input["az_snp_vtpm"].tpm.pcr08 in query_reference_value("snp_pcr08")
-      input["az_snp_vtpm"].tpm.pcr09 in query_reference_value("snp_pcr09")
-      input["az_snp_vtpm"].tpm.pcr11 in query_reference_value("snp_pcr11")
-      input["az_snp_vtpm"].tpm.pcr12 in query_reference_value("snp_pcr12")
+      input["az-snp-vtpm"]
+
+      # measurement check commented out per upstream default (launch measurement is Azure platform constant)
+      # input["az-snp-vtpm"].measurement in query_reference_value("measurement")
+      input["az-snp-vtpm"].tpm.pcr03 in query_reference_value("snp_pcr03")
+      input["az-snp-vtpm"].tpm.pcr08 in query_reference_value("snp_pcr08")
+      input["az-snp-vtpm"].tpm.pcr09 in query_reference_value("snp_pcr09")
+      input["az-snp-vtpm"].tpm.pcr11 in query_reference_value("snp_pcr11")
+      input["az-snp-vtpm"].tpm.pcr12 in query_reference_value("snp_pcr12")
     }
 
     hardware := 2 if {
-      input["az_snp_vtpm"]
+      input["az-snp-vtpm"]
 
-      # Check the reported TCB to validate the ASP FW
-      count(query_reference_value("tcb_bootloader")) > 0
-      input["az_snp_vtpm"].reported_tcb_bootloader in query_reference_value("tcb_bootloader")
-      input["az_snp_vtpm"].reported_tcb_microcode in query_reference_value("tcb_microcode")
-      input["az_snp_vtpm"].reported_tcb_snp in query_reference_value("tcb_snp")
-      input["az_snp_vtpm"].reported_tcb_tee in query_reference_value("tcb_tee")
-    }
-
-    # Fallback: TCB reference values not collected for Azure yet
-    else := 3 if {
-      input["az_snp_vtpm"]
+      # TCB checks commented out per upstream default — Azure manages TCB validation
+      # input["az-snp-vtpm"].reported_tcb_bootloader in query_reference_value("tcb_bootloader")
+      # input["az-snp-vtpm"].reported_tcb_microcode in query_reference_value("tcb_microcode")
+      # input["az-snp-vtpm"].reported_tcb_snp in query_reference_value("tcb_snp")
+      # input["az-snp-vtpm"].reported_tcb_tee in query_reference_value("tcb_tee")
     }
 
-    # For the 'configuration' trust claim 2 stands for
-    # "The configuration is a known and approved config."
-    #
-    # For this, we compare all the configuration fields.
     configuration := 2 if {
-      input["az_snp_vtpm"]
-
-      count(query_reference_value("smt_enabled")) > 0
-      input["az_snp_vtpm"].platform_smt_enabled in query_reference_value("smt_enabled")
-      input["az_snp_vtpm"].platform_tsme_enabled in query_reference_value("tsme_enabled")
-      input["az_snp_vtpm"].policy_abi_major in query_reference_value("abi_major")
-      input["az_snp_vtpm"].policy_abi_minor in query_reference_value("abi_minor")
-      input["az_snp_vtpm"].policy_single_socket in query_reference_value("single_socket")
-      input["az_snp_vtpm"].policy_smt_allowed in query_reference_value("smt_allowed")
-    }
-
-    # Fallback: configuration reference values not available
-    else := 3 if {
-      input["az_snp_vtpm"]
+      input["az-snp-vtpm"]
+
+      # Config checks commented out per upstream default — Azure platform constants
+      # input["az-snp-vtpm"].platform_smt_enabled in query_reference_value("smt_enabled")
+      # input["az-snp-vtpm"].platform_tsme_enabled in query_reference_value("tsme_enabled")
+      # input["az-snp-vtpm"].policy_abi_major in query_reference_value("abi_major")
+      # input["az-snp-vtpm"].policy_abi_minor in query_reference_value("abi_minor")
+      # input["az-snp-vtpm"].policy_single_socket in query_reference_value("single_socket")
+      # input["az-snp-vtpm"].policy_smt_allowed in query_reference_value("smt_allowed")
     }
 
     ##### Azure vTPM TDX
     executables := 3 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
 
-      input["az_tdx_vtpm"].tpm.pcr03 in query_reference_value("tdx_pcr03")
-      input["az_tdx_vtpm"].tpm.pcr08 in query_reference_value("tdx_pcr08")
-      input["az_tdx_vtpm"].tpm.pcr09 in query_reference_value("tdx_pcr09")
-      input["az_tdx_vtpm"].tpm.pcr11 in query_reference_value("tdx_pcr11")
-      input["az_tdx_vtpm"].tpm.pcr12 in query_reference_value("tdx_pcr12")
+      input["az-tdx-vtpm"].tpm.pcr03 in query_reference_value("tdx_pcr03")
+      input["az-tdx-vtpm"].tpm.pcr08 in query_reference_value("tdx_pcr08")
+      input["az-tdx-vtpm"].tpm.pcr09 in query_reference_value("tdx_pcr09")
+      input["az-tdx-vtpm"].tpm.pcr11 in query_reference_value("tdx_pcr11")
+      input["az-tdx-vtpm"].tpm.pcr12 in query_reference_value("tdx_pcr12")
     }
 
     hardware := 2 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
 
       # Check the quote is a TDX quote signed by Intel SGX Quoting Enclave
-      input["az_tdx_vtpm"].quote.header.tee_type == "81000000"
-      input["az_tdx_vtpm"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
+      input["az-tdx-vtpm"].quote.header.tee_type == "81000000"
+      input["az-tdx-vtpm"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
 
-      # Check OVMF code hash
-      count(query_reference_value("mr_td")) > 0
-      input["az_tdx_vtpm"].quote.body.mr_td in query_reference_value("mr_td")
+      # mr_td and OVMF checks commented out per upstream default
+      # input["az-tdx-vtpm"].quote.body.mr_td in query_reference_value("mr_td")
 
       # Check TCB status (covers quote.body.tcb_svn claim check)
-      input["az_tdx_vtpm"].tcb_status == "UpToDate"
-    }
-
-    # Fallback: mr_td reference values not collected for Azure yet
-    else := 3 if {
-      input["az_tdx_vtpm"]
-
-      input["az_tdx_vtpm"].quote.header.tee_type == "81000000"
-      input["az_tdx_vtpm"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
-      input["az_tdx_vtpm"].tcb_status == "UpToDate"
+      input["az-tdx-vtpm"].tcb_status == "UpToDate"
     }
 
     configuration := 2 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
 
-      count(query_reference_value("xfam")) > 0
-      input["az_tdx_vtpm"].quote.body.xfam in query_reference_value("xfam")
+      # xfam check commented out per upstream default
+      # input["az-tdx-vtpm"].quote.body.xfam in query_reference_value("xfam")
     }
 
     # Fallback: xfam reference values not available
     else := 3 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
     }
 
     ##### Bare Metal TDX
@@ -240,6 +217,18 @@ data:
       input["tdx"].collateral_expiration_status == "0"
     }
 
+    # Fallback: TCB OutOfDate — hardware is real TDX but has known advisories
+    else := 3 if {
+      input["tdx"]
+
+      input["tdx"].quote.header.tee_type == "81000000"
+      input["tdx"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
+
+      input["tdx"].quote.body.mr_td in query_reference_value("mr_td")
+
+      input["tdx"].collateral_expiration_status == "0"
+    }
+
     configuration := 2 if {
       input["tdx"]
 
diff --git a/templates/kbs-auth-dummy-secret.yaml b/templates/kbs-auth-dummy-secret.yaml
new file mode 100644
index 0000000..3dc409a
--- /dev/null
+++ b/templates/kbs-auth-dummy-secret.yaml
@@ -0,0 +1,14 @@
+# Dummy secret required by Trustee 1.2 operator.
+# The operator controller unconditionally creates a volume from
+# kbsAuthSecretName. Admin auth is disabled (authorization_mode = "DenyAll"),
+# so the content is irrelevant -- only existence matters.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kbs-auth-public-key
+  namespace: trustee-operator-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+type: Opaque
+data:
+  publicKey: ""
diff --git a/templates/kbs-config-map.yaml b/templates/kbs-config-map.yaml
index ef13389..1edc903 100644
--- a/templates/kbs-config-map.yaml
+++ b/templates/kbs-config-map.yaml
@@ -5,6 +5,7 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
   kbs-config.toml: |
     [http_server]
@@ -15,33 +16,19 @@ data:
     insecure_http = false
     private_key = "/etc/https-key/tls.key"
     certificate = "/etc/https-cert/tls.crt"
-    [admin]
-    {{- if eq (default "v1.0" .Values.kbs.admin.format) "v1.1" }}
-    type = "Simple"
-    insecure_api = false
 
-    [[admin.personas]]
-    id = "admin"
-    public_key_path = "/etc/auth-secret/publicKey"
-    {{- else }}
-    type = "DenyAll"
-    insecure_api = false
-    auth_public_key = "/etc/auth-secret/publicKey"
-    {{- end }}
+    [admin]
+    authorization_mode = "DenyAll"
 
     [attestation_token]
-    insecure_key = false
+    insecure_header_jwk = false
     attestation_token_type = "CoCo"
-    trusted_certs_paths = ["/etc/attestation-cert/tls.crt"] # Check for location in cert (based on key generated)
+    trusted_certs_paths = ["/etc/attestation-cert/tls.crt"]
 
     [attestation_service]
     type = "coco_as_builtin"
-    work_dir = "/opt/confidential-containers/attestation-service"
-    policy_engine = "opa"
 
     [attestation_service.attestation_token_broker]
-    type = "Ear"
-    policy_dir = "/opt/confidential-containers/attestation-service/policies"
 
     [attestation_service.attestation_token_broker.signer]
     key_path = "/etc/attestation-cert/tls.key"
@@ -52,20 +39,28 @@ data:
 
     [attestation_service.rvps_config]
     type = "BuiltIn"
-
-    [attestation_service.rvps_config.storage]
-    type = "LocalJson"
-    file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
+    storage_type = "LocalJson"
+    file_dir_path = "/opt/confidential-containers/storage/local_json"
     {{- if .Values.kbs.gpu.enabled }}
 
     [attestation_service.verifier_config.nvidia_verifier]
     type = "Remote"
     {{- end }}
+    {{- if .Values.kbs.tdx.enabled }}
+
+    [attestation_service.verifier_config.dcap_verifier]
+    collateral_service = "{{ .Values.kbs.tdx.collateralService }}"
+    {{- end }}
 
     [[plugins]]
     name = "resource"
-    type = "LocalFs"
-    dir_path = "/opt/confidential-containers/kbs/repository"
+    storage_backend_type = "kvstorage"
+
+    [storage_backend]
+    storage_type = "LocalFs"
+
+    [storage_backend.backends.local_fs]
+    dir_path = "/opt/confidential-containers/storage"
 
-    [policy_engine]
-    policy_path = "/opt/confidential-containers/opa/policy.rego"
\ No newline at end of file
+    [storage_backend.backends.local_json]
+    dir_path = "/opt/confidential-containers/storage/local_json"
diff --git a/templates/kbs.yaml b/templates/kbs.yaml
index c0e3644..1718c95 100644
--- a/templates/kbs.yaml
+++ b/templates/kbs.yaml
@@ -22,6 +22,7 @@ spec:
     {{- end }}
     - "security-policy"
     - "attestation-status"
+    - "signing-key"
   kbsHttpsKeySecretName: kbs-https-key
   kbsHttpsCertSecretName: kbs-https-certificate
   kbsResourcePolicyConfigMapName: resource-policy
@@ -30,12 +31,6 @@ spec:
   kbsAttestationKeySecretName: attestation-cert
 
 
-  # TDX specific configuration (optional)
-  {{- if .Values.kbs.tdx.enabled }}
-  tdxConfigSpec:
-    kbsTdxConfigMapName: tdx-config
-  {{- end }}
-
   # IBM SE specific configuration (optional)
   # ibmSEConfigSpec:
   #   certStorePvc: <persistent-volume-claim>
diff --git a/templates/pull-secret-credential-policy.yaml b/templates/pull-secret-credential-policy.yaml
index 20fb76e..c456d44 100644
--- a/templates/pull-secret-credential-policy.yaml
+++ b/templates/pull-secret-credential-policy.yaml
@@ -1,4 +1,7 @@
-{{ if eq .Values.global.coco.secured  true }}
+{{- if and (eq .Values.global.coco.secured true) (ne .Values.global.clusterPlatform "Azure") }}
+{{- /* On Azure peer-pods, CDH does not fetch registry credentials from KBS.
+       Pull secrets are distributed to workload namespace SAs instead
+       (see sandboxed-policies-chart/pull-secret-distribution.yaml). */ -}}
 ---
 apiVersion: policy.open-cluster-management.io/v1
 kind: Policy
diff --git a/templates/reference-values.yaml b/templates/reference-values.yaml
index 258e4af..485d3bf 100644
--- a/templates/reference-values.yaml
+++ b/templates/reference-values.yaml
@@ -6,6 +6,7 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
-  reference-values.json: '[]'
+  reference_value: '{}'
 {{ end }}
\ No newline at end of file
diff --git a/templates/resource-policy.yaml b/templates/resource-policy.yaml
index 3c2b583..39330ed 100644
--- a/templates/resource-policy.yaml
+++ b/templates/resource-policy.yaml
@@ -5,8 +5,9 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
-  policy.rego: |
+  resource-policy.rego: |
     package policy
     import rego.v1
 
diff --git a/templates/rvps-values-policies.yaml b/templates/rvps-values-policies.yaml
index 5b97de0..42290d2 100644
--- a/templates/rvps-values-policies.yaml
+++ b/templates/rvps-values-policies.yaml
@@ -25,7 +25,9 @@ spec:
           {{`{{- $debugRawHash := fromConfigMap "imperative" "debug-initdata" "RAW_HASH" -}}`}}
           {{`{{- $rawHashPadded := printf "%s00000000000000000000000000000000" $rawHash -}}`}}
           {{`{{- $debugRawHashPadded := printf "%s00000000000000000000000000000000" $debugRawHash -}}`}}
-          {{`{{- $referenceValues := list (dict "name" "init_data" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash $rawHash $debugRawHash $rawHashPadded $debugRawHashPadded)) -}}`}}
+          {{`{{- $referenceValues := dict -}}`}}
+          {{`{{- $entry := dict "version" "0.1.0" "name" "init_data" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash $rawHash $debugRawHash $rawHashPadded $debugRawHashPadded) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "init_data" (toJson $entry | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- $pcrStash := (lookup "v1" "Secret" "trustee-operator-system" "pcr-stash") -}}`}}
           {{`{{- if $pcrStash -}}`}}
           {{`{{- $secretData := $pcrStash.data.json | base64dec | fromJson -}}`}}
@@ -33,36 +35,69 @@ spec:
           {{`{{- $pcr09 := $secretData.measurements.sha256.pcr09 -}}`}}
           {{`{{- $pcr11 := $secretData.measurements.sha256.pcr11 -}}`}}
           {{`{{- $pcr12 := $secretData.measurements.sha256.pcr12 -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12)) -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12)) -}}`}}
+          {{`{{- $e := dict "version" "0.1.0" "name" "snp_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "snp_pcr03" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "tdx_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "tdx_pcr03" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "snp_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "snp_pcr08" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "tdx_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "tdx_pcr08" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "snp_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "snp_pcr09" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "tdx_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "tdx_pcr09" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "snp_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "snp_pcr11" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "tdx_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "tdx_pcr11" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "snp_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "snp_pcr12" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "tdx_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "tdx_pcr12" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- end -}}`}}
           {{`{{- $firmwareStash := (lookup "v1" "Secret" "trustee-operator-system" "firmware-reference-values") -}}`}}
           {{`{{- if $firmwareStash -}}`}}
           {{`{{- $firmwareData := $firmwareStash.data.json | base64dec | fromJson -}}`}}
           {{`{{- if $firmwareData.mr_td -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "mr_td" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.mr_td) -}}`}}
+          {{`{{- $e := dict "version" "0.1.0" "name" "mr_td" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.mr_td -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "mr_td" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- end -}}`}}
           {{`{{- if $firmwareData.rtmr_1 -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "rtmr_1" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.rtmr_1) -}}`}}
+          {{`{{- $e := dict "version" "0.1.0" "name" "rtmr_1" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.rtmr_1 -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "rtmr_1" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- end -}}`}}
           {{`{{- if $firmwareData.rtmr_2 -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "rtmr_2" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.rtmr_2) -}}`}}
+          {{`{{- $e := dict "version" "0.1.0" "name" "rtmr_2" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.rtmr_2 -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "rtmr_2" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- end -}}`}}
           {{`{{- if $firmwareData.snp_launch_measurement -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "snp_launch_measurement" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_launch_measurement) -}}`}}
+          {{`{{- $e := dict "version" "0.1.0" "name" "snp_launch_measurement" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.snp_launch_measurement -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "snp_launch_measurement" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- end -}}`}}
           {{`{{- if $firmwareData.xfam -}}`}}
-          {{`{{- $referenceValues = append $referenceValues (dict "name" "xfam" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.xfam) -}}`}}
+          {{`{{- $e := dict "version" "0.1.0" "name" "xfam" "expiration" "2027-12-12T00:00:00Z" "value" $firmwareData.xfam -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "xfam" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
           {{`{{- end -}}`}}
           {{`{{- end -}}`}}
+          {{- if .Values.kbs.azure }}
+          {{- with .Values.kbs.azure }}
+          {{`{{- $e := dict "version" "0.1.0" "name" "measurement" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .snpLaunchMeasurement }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "measurement" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "smt_enabled" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .smtEnabled }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "smt_enabled" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "tsme_enabled" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .tsmeEnabled }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "tsme_enabled" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "abi_major" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .abiMajor }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "abi_major" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "abi_minor" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .abiMinor }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "abi_minor" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "single_socket" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .singleSocket }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "single_socket" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{`{{- $e = dict "version" "0.1.0" "name" "smt_allowed" "expiration" "2099-12-31T00:00:00Z" "value" (list `}} "{{ .smtAllowed }}" {{`) -}}`}}
+          {{`{{- $referenceValues = set $referenceValues "smt_allowed" (toJson $e | base64enc | replace "+" "-" | replace "/" "_") -}}`}}
+          {{- end }}
+          {{- end }}
           - complianceType: mustonlyhave
             objectDefinition:
               apiVersion: v1
@@ -70,8 +105,10 @@ spec:
               metadata:
                 name: rvps-reference-values
                 namespace: trustee-operator-system
+                annotations:
+                  kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
               data:
-                reference-values.json: '{{`{{ toJson $referenceValues }}`}}'
+                reference_value: '{{`{{ toJson $referenceValues }}`}}'
 ---
 apiVersion: policy.open-cluster-management.io/v1
 kind: PlacementBinding
@@ -103,4 +140,4 @@ spec:
     matchLabels:
       local-cluster: "true"
 ---
-{{ end }}
\ No newline at end of file
+{{ end }}
diff --git a/templates/kbs-operator-keys.yaml b/templates/sealed-secrets-signing-eso.yaml
similarity index 77%
rename from templates/kbs-operator-keys.yaml
rename to templates/sealed-secrets-signing-eso.yaml
index dba5139..8db1dbb 100644
--- a/templates/kbs-operator-keys.yaml
+++ b/templates/sealed-secrets-signing-eso.yaml
@@ -5,19 +5,18 @@ kind: ExternalSecret
 metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "1"
-  name: kbs-auth-public-key-eso
+  name: sealed-secrets-signing-key-eso
   namespace: trustee-operator-system
 spec:
   refreshInterval: 15s
   secretStoreRef:
     name: {{ .Values.secretStore.name }}
     kind: {{ .Values.secretStore.kind }}
-  data:
   target:
-    name: kbs-auth-public-key
+    name: signing-key
     template:
       type: Opaque
   dataFrom:
   - extract:
-      key: {{ .Values.kbs.publicKey }}
-{{- end }}
\ No newline at end of file
+      key: secret/data/hub/sealedSecretsSigningKey
+{{- end }}
diff --git a/templates/tdx-config.yaml b/templates/tdx-config.yaml
deleted file mode 100644
index dcf8db2..0000000
--- a/templates/tdx-config.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.kbs.tdx.enabled }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tdx-config
-  namespace: trustee-operator-system
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
-data:
-  sgx_default_qcnl.conf: |
-    {
-      "collateral_service": "{{ .Values.kbs.tdx.collateralService }}",
-      "use_secure_cert": false
-    }
-{{- end }}
diff --git a/values.yaml b/values.yaml
index 1b1b4f5..93fa0aa 100644
--- a/values.yaml
+++ b/values.yaml
@@ -20,18 +20,10 @@ global:
 
 # KBS (Key Broker Service) configuration
 kbs:
-  admin:
-    # Admin config format: "v1.0" for Trustee 1.0 (auth_public_key),
-    # "v1.1" for Trustee 1.1+ (type = "Simple" with [[admin.personas]])
-    format: "v1.0"
-
   # Security policy is an expected secret and is required to be pushed into the KBS
   # presumes security policy flavour is signed
   cosignKeys: secret/data/hub/coSignKeys
 
-  # Public key for authentication by a user with the KBS management API
-  publicKey: secret/data/hub/kbsPublicKey
-
   # Dynamic secret resources list - add new secrets here
   # Each entry generates an ESO and gets added to kbsSecretResources
   # requires a name of the secret and a key to retrieve using ESO, typically from vault.
@@ -78,6 +70,37 @@ kbs:
     # See docs/firmware-reference-values.md in coco-pattern for collection workflow
     enabled: false
 
+  # Azure SEV-SNP platform configuration reference values
+  # These are used by the attestation policy to verify the CVM configuration.
+  # The values below are defaults for Azure DCasv5-series VMs (AMD SEV-SNP).
+  #
+  # These are Azure platform constants that describe the SEV-SNP policy
+  # enforced by Azure for confidential VMs. They may vary by:
+  #
+  #   VM Series       | SMT | TSME | ABI Minor | Notes
+  #   ----------------|-----|------|-----------|------
+  #   DCasv5 (Genoa)  | true| true | 31        | Standard CoCo peer-pod VMs
+  #   DCadsv5 (Genoa) | true| true | 31        | With local NVMe
+  #   ECasv5 (Genoa)  | true| true | 31        | Memory-optimized
+  #   DCesv5 (Milan)  | true| true | 31        | Earlier generation, may differ
+  #
+  # The SNP launch measurement (snpLaunchMeasurement) is a hash of the
+  # Azure UEFI firmware + vTPM initial state. It is static per Azure CVM
+  # firmware generation but will change when Azure updates the firmware.
+  # It is NOT derived from the workload image — it is an Azure platform
+  # constant for the VM type.
+  #
+  # If attestation fails on configuration/executables claims, check the
+  # trustee logs for the actual values reported by the VM and update these.
+  azure:
+    snpLaunchMeasurement: "qnydpVwThuWxZTsSWXi+2ns/laha6w+d2723g84FaijJ0CHaI5w0pYw6ZXZUJw7v"
+    smtEnabled: "true"
+    tsmeEnabled: "true"
+    abiMajor: "0"
+    abiMinor: "31"
+    singleSocket: "false"
+    smtAllowed: "true"
+
   # Resource policy configuration
   resourcePolicy:
     # Enforce hardware trust claims in resource policy