diff --git a/roles/network_plugin/cilium/defaults/main.yml b/roles/network_plugin/cilium/defaults/main.yml
index 79681e054..8496c8716 100644
--- a/roles/network_plugin/cilium/defaults/main.yml
+++ b/roles/network_plugin/cilium/defaults/main.yml
@@ -26,7 +26,10 @@ cilium_cpu_limit: 500m
 cilium_memory_requests: 64M
 cilium_cpu_requests: 100m
 
-# Overlay Network Mode
+# Cilium tunnel mode. Possible values: vxlan, geneve, disabled.
+# Set to 'disabled' to use native routing without tunneling.
+# When set to 'disabled', Kubespray renders routingMode: native in the Helm
+# values instead of tunnelProtocol, which is required by Cilium >= 1.14.
 cilium_tunnel_mode: vxlan
 
 # LoadBalancer Mode (snat/dsr/hybrid) Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#dsr-mode
diff --git a/roles/network_plugin/cilium/templates/values.yaml.j2 b/roles/network_plugin/cilium/templates/values.yaml.j2
index 8e2da3f0a..39179fb8c 100644
--- a/roles/network_plugin/cilium/templates/values.yaml.j2
+++ b/roles/network_plugin/cilium/templates/values.yaml.j2
@@ -25,7 +25,11 @@ healthPort: {{ cilium_agent_health_port }}
 
 identityAllocationMode: {{ cilium_identity_allocation_mode }}
 
+{% if cilium_tunnel_mode == 'disabled' %}
+routingMode: native
+{% else %}
 tunnelProtocol: {{ cilium_tunnel_mode }}
+{% endif %}
 
 loadBalancer:
   mode: {{ cilium_loadbalancer_mode }}