diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 89ab44f..babbe84 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -31,8 +31,7 @@ trigger-downstream:
     strategy: depend
   variables:
     TERRAFORM_IMAGE_NAME: cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.10
-    YC_IAM_TOKEN: ${YC_IAM_TOKEN}
-    YC_TOKEN: ${YC_IAM_TOKEN}
+    YC_SERVICE_ACCOUNT_KEY_FILE: ${YC_SERVICE_ACCOUNT_KEY_FILE}
     YC_CLOUD_ID: ${YC_CLOUD_ID}
     YC_STAGE_FOLDER_ID: ${YC_STAGE_FOLDER_ID}
     YC_PROD_FOLDER_ID: ${YC_PROD_FOLDER_ID}
diff --git a/live/stage/database/terragrunt.hcl b/live/stage/database/terragrunt.hcl
index beb31de..388dfb5 100644
--- a/live/stage/database/terragrunt.hcl
+++ b/live/stage/database/terragrunt.hcl
@@ -22,9 +22,10 @@ terraform {
 inputs = {
   databases = local.env_config.databases
 
-  yc_token        = get_env("YC_TOKEN", "")
-  yc_cloud_id     = get_env("YC_CLOUD_ID", "")
-  yc_folder_id    = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
-  kubeconfig_path = get_env("KUBECONFIG", "")
-  kube_context    = get_env("KUBE_CONTEXT", "")
+  yc_token                    = get_env("YC_TOKEN", "")
+  yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
+  yc_cloud_id                 = get_env("YC_CLOUD_ID", "")
+  yc_folder_id                = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
+  kubeconfig_path             = get_env("KUBECONFIG", "")
+  kube_context                = get_env("KUBE_CONTEXT", "")
 }
diff --git a/live/stage/namespace/terragrunt.hcl b/live/stage/namespace/terragrunt.hcl
index ce8ed56..5a4235e 100644
--- a/live/stage/namespace/terragrunt.hcl
+++ b/live/stage/namespace/terragrunt.hcl
@@ -22,9 +22,10 @@ terraform {
 inputs = {
   namespaces = local.env_config.namespaces
 
-  yc_token        = get_env("YC_TOKEN", "")
-  yc_cloud_id     = get_env("YC_CLOUD_ID", "")
-  yc_folder_id    = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
-  kubeconfig_path = get_env("KUBECONFIG", "")
-  kube_context    = get_env("KUBE_CONTEXT", "")
+  yc_token                    = get_env("YC_TOKEN", "")
+  yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
+  yc_cloud_id                 = get_env("YC_CLOUD_ID", "")
+  yc_folder_id                = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
+  kubeconfig_path             = get_env("KUBECONFIG", "")
+  kube_context                = get_env("KUBE_CONTEXT", "")
 }
diff --git a/live/stage/s3/terragrunt.hcl b/live/stage/s3/terragrunt.hcl
index 6288365..e8ef9ca 100644
--- a/live/stage/s3/terragrunt.hcl
+++ b/live/stage/s3/terragrunt.hcl
@@ -30,9 +30,10 @@ inputs = {
   cors_enabled      = try(local.bucket.cors.enabled, false)
   cors_config       = try(local.bucket.cors, {})
   
-  yc_token       = get_env("YC_TOKEN", "")
-  yc_cloud_id    = get_env("YC_CLOUD_ID", "")
-  yc_folder_id   = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
-  kubeconfig_path = get_env("KUBECONFIG", "")
-  kube_context   = get_env("KUBE_CONTEXT", "")
+  yc_token                    = get_env("YC_TOKEN", "")
+  yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
+  yc_cloud_id                 = get_env("YC_CLOUD_ID", "")
+  yc_folder_id                = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
+  kubeconfig_path             = get_env("KUBECONFIG", "")
+  kube_context                = get_env("KUBE_CONTEXT", "")
 }
diff --git a/live/stage/secrets/terragrunt.hcl b/live/stage/secrets/terragrunt.hcl
index d1ab33f..d376ef6 100644
--- a/live/stage/secrets/terragrunt.hcl
+++ b/live/stage/secrets/terragrunt.hcl
@@ -162,9 +162,10 @@ inputs = {
     DOCKER_REGISTRY_PASSWORD = get_env("DOCKER_REGISTRY_PASSWORD", "")
   }
 
-  yc_token        = get_env("YC_TOKEN", "")
-  yc_cloud_id     = get_env("YC_CLOUD_ID", "")
-  yc_folder_id    = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
-  kubeconfig_path = get_env("KUBECONFIG", "")
-  kube_context    = get_env("KUBE_CONTEXT", "")
+  yc_token                    = get_env("YC_TOKEN", "")
+  yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
+  yc_cloud_id                 = get_env("YC_CLOUD_ID", "")
+  yc_folder_id                = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
+  kubeconfig_path             = get_env("KUBECONFIG", "")
+  kube_context                = get_env("KUBE_CONTEXT", "")
 }
diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl
index 462bd07..56aa657 100644
--- a/live/terragrunt.hcl
+++ b/live/terragrunt.hcl
@@ -44,10 +44,11 @@ terraform {
 }
 
 provider "yandex" {
-  token     = var.yc_token != "" ? var.yc_token : null
-  cloud_id  = var.yc_cloud_id != "" ? var.yc_cloud_id : null
-  folder_id = var.yc_folder_id != "" ? var.yc_folder_id : null
-  zone      = "ru-central1-a"
+  token                    = var.yc_token != "" ? var.yc_token : null
+  service_account_key_file = var.yc_service_account_key_file != "" ? var.yc_service_account_key_file : null
+  cloud_id                 = var.yc_cloud_id != "" ? var.yc_cloud_id : null
+  folder_id                = var.yc_folder_id != "" ? var.yc_folder_id : null
+  zone                     = "ru-central1-a"
 }
 
 provider "kubernetes" {
@@ -60,7 +61,13 @@ provider "kubernetes" {
 variable "yc_token" {
   type        = string
   default     = ""
-  description = "Yandex Cloud token"
+  description = "Yandex Cloud IAM token"
+}
+
+variable "yc_service_account_key_file" {
+  type        = string
+  default     = ""
+  description = "Path to Yandex Cloud service account key file"
 }
 
 variable "yc_cloud_id" {
diff --git a/terraform-ci-key.json b/terraform-ci-key.json
new file mode 100644
index 0000000..d0f4dbc
--- /dev/null
+++ b/terraform-ci-key.json
@@ -0,0 +1,8 @@
+{
+   "id": "ajeltr9dksm63krpipec",
+   "service_account_id": "ajeko93ag13utrag123u",
+   "created_at": "2026-01-28T11:20:10.340482495Z",
+   "key_algorithm": "RSA_2048",
+   "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArzZ9VB9wqbrFv9pXuqKN\ndBY94CBcSgT5RrYvgbHnyCvoUolRHwgztnDWJLnofWjrAtrjw277SLscngXRYFuN\n0lKUPreRcoAn61gzGonx7rB2E2Z7zx6Piq7o40n4Q6TWibOmZh5USoBaaSpA+Kd0\nu/W0b6J7kvbLTSqbf5/x27Rntt1JhFptrKl9zabwVj5abvwsjnoHmZsHjG43jDEr\n+XQg1i6B4EBClpFLEHr7HVh7dhojgnJL7sbCah5I5xyyGnj+bb0291X9WeDXajWz\nJYACfngS2Ees0xQLZB+wbsi8m9doEs5JtVljL3htq8S6hARg3Uy2NHQpWqkbaY7a\n7QIDAQAB\n-----END PUBLIC KEY-----\n",
+   "private_key": "PLEASE DO NOT REMOVE THIS LINE! Yandex.Cloud SA Key ID \u003cajeltr9dksm63krpipec\u003e\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCvNn1UH3CpusW/\n2le6oo10Fj3gIFxKBPlGti+BsefIK+hSiVEfCDO2cNYkueh9aOsC2uPDbvtIuxye\nBdFgW43SUpQ+t5FygCfrWDMaifHusHYTZnvPHo+KrujjSfhDpNaJs6ZmHlRKgFpp\nKkD4p3S79bRvonuS9stNKpt/n/HbtGe23UmEWm2sqX3NpvBWPlpu/CyOegeZmweM\nbjeMMSv5dCDWLoHgQEKWkUsQevsdWHt2GiOCckvuxsJqHkjnHLIaeP5tvTb3Vf1Z\n4NdqNbMlgAJ+eBLYR6zTFAtkH7BuyLyb12gSzkm1WWMveG2rxLqEBGDdTLY0dCla\nqRtpjtrtAgMBAAECggEABCcfzqqgGlBu93POuIG50JKRDOA3em77vuKlOvG4iKoM\na524P9Vgmbu67PaVvW3ghBokDoccNZvEZd/FbVSThp9RHDDFpcJxL8bQue74aQE4\nYJABRzt2M4H0dc6pr7tsdP8Tu+qOx4/wlKWHvLJbYJ5w6bnJgVuQHgLF2hSJwFH6\n8vn+oRUW9m52bz8Uci+75tYxwsaJ37dqFQSERh+hFnoKK0kYqRw8qFkecHc8gwjH\nawLcOMcCHl08Olvz7x6+ufa/P5WWF0WZVbb2QWz+RmzENFKZ+bplPEWRTatutG5k\nOitqaDIdeYvU4oMvxNWpcL6jxpK3ebbNqp5FShtggQKBgQDOVyd3J9cDyzSky2Em\nKWUmYb/SPNvyhOpxHVOuvVycv+12IwV89fyhvLH/81CO56mlfDxwM8E9EupTKc+I\nTKwQIYO9vGxY7+xvMTQ8sMd6MsW2om8SOKchj2Km+PhMuKBXJn0oDZVE30RGzRw+\nWXS6BuwqzZXv/9dCdcqEMd8BtQKBgQDZYYhKRe0aMW10FczDJ4uCg/2gskE+ddLK\ncRevRGiTfgJ+wK+CrwFqCew9Akz7G4pk1960r4FWDIfYkx7o+AxYdjAp5QmdSIHY\nw8N2ZyaivXz+jOepjRuNBbP9Q+seS58rIllGrT1bsLsOJ3UUSip9kKNxMSS/Uo/R\nyMC4jmAXWQKBgGyeXm0QMNSTbMPvN9XB5rg8rqB6XwIcS9l9qaaLkiwFsHgG2YW9\na96sGTt2FwsTEi/F5X7fD7MZuPZMRS4nxk+7hMElZhevPNQPn8LvACLohUGt4jBC\nWGCHPVROLU8dxXH7Fdk2xUP7D9MBeAOuTY77w+iIToyHLgaTQSczpYQdAoGABkyA\nMX7DNw4VmNaE32bG8Ro4AC8KGvA5EmqigA6gZR2yns+ghk3h4Zu1/7KQXnpW0UM8\nDcpEGiU0zn68141QdkO+c4hSdf9C2/AYOtcUVITfGVUl5VDUaoquw3jzWCZiz1Io\nehbM/1oooWldSCA6CPdm9QGyieSvjCmgA/kEKckCgYEAsp4s9OtOvdg1vPgIMCc+\nvjZcfgRbgu7mLYLdrbMKfnhM13CQycALbtMt6+njY+6NhJ9rrPr/38bQZktsapyb\nrCbAzjOUTrhBW+DEH3H52p5ZKVaVI+bO57IAuoN+nSBcymxP+doJdLnlzo4g0PO/\n68tzwroIjIhj0KT/UAqiRLo=\n-----END PRIVATE KEY-----\n"
+}
\ No newline at end of file