diff --git a/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go b/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go
index d25f3a367483..ff487f42c2db 100644
--- a/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go
+++ b/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go
@@ -376,6 +376,12 @@ func (h *hostpathCSIDriver) PrepareTest(ctx context.Context, f *framework.Framew
 		framework.Failf("deploying %s driver: %v", h.driverInfo.Name, err)
 	}
 
+	if h.driverInfo.Capabilities[storageframework.CapSnapshotMetadata] {
+		if err := utils.CreateSnapshotMetadataTLSSecret(ctx, f, driverns); err != nil {
+			framework.Failf("creating snapshot metadata TLS secret: %v", err)
+		}
+	}
+
 	cleanupFunc := generateDriverCleanupFunc(
 		f,
 		h.driverInfo.Name,
diff --git a/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go b/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go
index a272044e7ec9..c574ed2f0fcf 100644
--- a/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go
+++ b/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go
@@ -29,6 +29,7 @@ import (
 
 	"github.com/onsi/ginkgo/v2"
 	v1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -145,7 +146,11 @@ func createTLSSecret(ctx context.Context, f *framework.Framework, driverNamespac
 
 	client := f.ClientSet.CoreV1().Secrets(driverNamespace)
 	if _, err := client.Create(ctx, tlsSecret, metav1.CreateOptions{}); err != nil {
-		return fmt.Errorf("failed to create or update TLS secret: %w", err)
+		if apierrors.IsAlreadyExists(err) {
+			framework.Logf("TLS secret already exists: %s", tlsSecret.Name)
+			return nil
+		}
+		return fmt.Errorf("failed to create TLS secret: %w", err)
 	}
 
 	framework.Logf("TLS secret created successfully: %s", tlsSecret.Name)
@@ -216,6 +221,28 @@ func createSnapshotMetdataServiceCR(ctx context.Context, f *framework.Framework,
 	return nil
 }
 
+// CreateSnapshotMetadataTLSSecret creates only the TLS secret needed by the
+// csi-snapshot-metadata sidecar. Use this in PrepareTest when CapSnapshotMetadata
+// is enabled so the driver pod can mount the secret without requiring the full
+// set of snapshot metadata resources (Service, SnapshotMetadataService CR).
+func CreateSnapshotMetadataTLSSecret(ctx context.Context, f *framework.Framework, driverNamespace string) error {
+	caCert, caPrivateKey, err := generateCA()
+	if err != nil {
+		return fmt.Errorf("failed to generate CA certificate: %w", err)
+	}
+
+	serverCertBytes, serverKeyBytes, err := generateServerCert(driverNamespace, caCert, caPrivateKey)
+	if err != nil {
+		return fmt.Errorf("failed to generate server certificate: %w", err)
+	}
+
+	if err := createTLSSecret(ctx, f, driverNamespace, serverCertBytes, serverKeyBytes); err != nil {
+		return fmt.Errorf("failed to create TLS secret: %w", err)
+	}
+
+	return nil
+}
+
 // CreateSnapshotMetadataResources sets up the snapshot metadata resources.
 // CRD creation is handled separately by the test runner script.
 func CreateSnapshotMetadataResources(ctx context.Context, f *framework.Framework, driverName, driverNamespace string) error {