diff --git a/charts/helm_lib/Chart.yaml b/charts/helm_lib/Chart.yaml
index d4230a7..370672d 100644
--- a/charts/helm_lib/Chart.yaml
+++ b/charts/helm_lib/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
 type: library
 name: deckhouse_lib_helm
-version: 1.72.5
+version: 1.72.6
 description: "Helm utils template definitions for Deckhouse modules."
diff --git a/charts/helm_lib/README.md b/charts/helm_lib/README.md
index befff6d..592f9f6 100644
--- a/charts/helm_lib/README.md
+++ b/charts/helm_lib/README.md
@@ -311,10 +311,12 @@ list:
  .uid  – int, runAsUser/runAsGroup (default 64535) 
  .runAsNonRoot   – bool, run as Deckhouse user when true, root when false (default true) 
  .seccompProfile  – bool, disable seccompProfile when false (default true) 
+ .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) 
+ .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) 
 
 #### Usage
 
-`include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) `
+`include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") `
 
 
 
@@ -1249,10 +1251,12 @@ list:
  .uid  – int, runAsUser/runAsGroup (default 64535) 
  .runAsNonRoot   – bool, run as Deckhouse user when true, root when false (default true) 
  .seccompProfile  – bool, disable seccompProfile when false (default true) 
+ .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) 
+ .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) 
 
 #### Usage
 
-`include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) `
+`include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") `
 
 
 
diff --git a/charts/helm_lib/templates/_application_security_context.tpl b/charts/helm_lib/templates/_application_security_context.tpl
index fd21083..9ab9910 100644
--- a/charts/helm_lib/templates/_application_security_context.tpl
+++ b/charts/helm_lib/templates/_application_security_context.tpl
@@ -76,7 +76,9 @@ securityContext:
 {{- /* .uid  – int, runAsUser/runAsGroup (default 64535) */ -}}
 {{- /* .runAsNonRoot   – bool, run as Deckhouse user when true, root when false (default true) */ -}}
 {{- /* .seccompProfile  – bool, disable seccompProfile when false (default true) */ -}}
-{{- /* Usage: include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) */ -}}
+{{- /* .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) */ -}}
+{{- /* .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) */ -}}
+{{- /* Usage: include "helm_lib_application_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") */ -}}
 {{- define "helm_lib_application_container_security_context_pss_restricted_flexible" -}}
 {{- $ro := true -}}
 {{- if hasKey . "ro" -}}
@@ -86,6 +88,14 @@ securityContext:
 {{- if hasKey . "seccompProfile" -}}
   {{- $seccompProfile = .seccompProfile -}}
 {{- end -}}
+{{- $appArmorProfile := "RuntimeDefault" -}}
+{{- if hasKey . "appArmorProfile" -}}
+  {{- $appArmorProfile = .appArmorProfile -}}
+{{- end -}}
+{{- $appArmorProfileLocalhost := "" -}}
+{{- if hasKey . "appArmorProfileLocalhost" -}}
+  {{- $appArmorProfileLocalhost = .appArmorProfileLocalhost -}}
+{{- end -}}
 {{- $caps := default (list) .caps -}}
 {{- $uid  := default 64535 .uid  -}}
 {{- $runAsNonRoot := true -}}
@@ -112,6 +122,13 @@ securityContext:
   seccompProfile:
     type: RuntimeDefault
 {{- end }}
+{{- if $appArmorProfile }}
+  appArmorProfile:
+    type: {{ $appArmorProfile }}
+{{- if and (eq $appArmorProfile "Localhost") $appArmorProfileLocalhost }}
+    localhostProfile: {{ $appArmorProfileLocalhost }}
+{{- end }}
+{{- end }}
 {{- end }}
 
 
diff --git a/charts/helm_lib/templates/_module_security_context.tpl b/charts/helm_lib/templates/_module_security_context.tpl
index 1f51081..3501e89 100644
--- a/charts/helm_lib/templates/_module_security_context.tpl
+++ b/charts/helm_lib/templates/_module_security_context.tpl
@@ -76,7 +76,9 @@ securityContext:
 {{- /* .uid  – int, runAsUser/runAsGroup (default 64535) */ -}}
 {{- /* .runAsNonRoot   – bool, run as Deckhouse user when true, root when false (default true) */ -}}
 {{- /* .seccompProfile  – bool, disable seccompProfile when false (default true) */ -}}
-{{- /* Usage: include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true) */ -}}
+{{- /* .appArmorProfile – string, appArmorProfile.type, set to empty string to disable (default RuntimeDefault) */ -}}
+{{- /* .appArmorProfileLocalhost – string, appArmorProfile.localhostProfile, used only when appArmorProfile is "Localhost" (default empty) */ -}}
+{{- /* Usage: include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "ro" false "caps" (list "NET_ADMIN" "SYS_TIME") "uid" 1001 "seccompProfile" false "runAsNonRoot" true "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") */ -}}
 {{- define "helm_lib_module_container_security_context_pss_restricted_flexible" -}}
 {{- $ro := true -}}
 {{- if hasKey . "ro" -}}
@@ -86,6 +88,14 @@ securityContext:
 {{- if hasKey . "seccompProfile" -}}
   {{- $seccompProfile = .seccompProfile -}}
 {{- end -}}
+{{- $appArmorProfile := "RuntimeDefault" -}}
+{{- if hasKey . "appArmorProfile" -}}
+  {{- $appArmorProfile = .appArmorProfile -}}
+{{- end -}}
+{{- $appArmorProfileLocalhost := "" -}}
+{{- if hasKey . "appArmorProfileLocalhost" -}}
+  {{- $appArmorProfileLocalhost = .appArmorProfileLocalhost -}}
+{{- end -}}
 {{- $caps := default (list) .caps -}}
 {{- $uid  := default 64535 .uid  -}}
 {{- $runAsNonRoot := true -}}
@@ -112,6 +122,13 @@ securityContext:
   seccompProfile:
     type: RuntimeDefault
 {{- end }}
+{{- if $appArmorProfile }}
+  appArmorProfile:
+    type: {{ $appArmorProfile }}
+{{- if and (eq $appArmorProfile "Localhost") $appArmorProfileLocalhost }}
+    localhostProfile: {{ $appArmorProfileLocalhost }}
+{{- end }}
+{{- end }}
 {{- end }}
 
 
diff --git a/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml b/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml
new file mode 100644
index 0000000..d664912
--- /dev/null
+++ b/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml
@@ -0,0 +1 @@
+{{ include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "appArmorProfile" "Localhost" "appArmorProfileLocalhost" "k8s-apparmor-example-deny-write") }}
diff --git a/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml b/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml
new file mode 100644
index 0000000..7d5d4a7
--- /dev/null
+++ b/tests/templates/helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml
@@ -0,0 +1 @@
+{{ include "helm_lib_module_container_security_context_pss_restricted_flexible" (dict "appArmorProfile" "") }}
diff --git a/tests/tests/helm_lib_application_container_security_context_test.yaml b/tests/tests/helm_lib_application_container_security_context_test.yaml
index 06fac31..6cd2d74 100644
--- a/tests/tests/helm_lib_application_container_security_context_test.yaml
+++ b/tests/tests/helm_lib_application_container_security_context_test.yaml
@@ -18,11 +18,13 @@ tests:
             securityContext:
               readOnlyRootFilesystem: true
               allowPrivilegeEscalation: false
+              appArmorProfile:
+                type: RuntimeDefault
               capabilities:
                 drop:
                   - ALL
               runAsUser: 64535
-              runAsGroup: 64535  
+              runAsGroup: 64535
               privileged: false
               runAsNonRoot: true
 
@@ -43,6 +45,8 @@ tests:
               runAsNonRoot: true
               seccompProfile:
                 type: RuntimeDefault
+              appArmorProfile:
+                type: RuntimeDefault
 
   - it: read_only_root_filesystem default options
     asserts:
diff --git a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml
index 802b8ae..9e9b6d3 100644
--- a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml
+++ b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test.yaml
@@ -1,8 +1,12 @@
 suite: helm_lib_module_container_security_context_pss_restricted_flexible
 templates:
   - helm_lib_module_container_security_context_pss_restricted_flexible.yaml
+  - helm_lib_module_container_security_context_pss_restricted_flexible_seccomp_disabled.yaml
+  - helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml
+  - helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml
 tests:
   - it: default options
+    template: helm_lib_module_container_security_context_pss_restricted_flexible.yaml
     asserts:
       - equal:
           path: securityContext
@@ -18,3 +22,35 @@ tests:
             runAsNonRoot: true
             seccompProfile:
               type: RuntimeDefault
+            appArmorProfile:
+              type: RuntimeDefault
+  - it: seccompProfile disabled still has appArmorProfile
+    template: helm_lib_module_container_security_context_pss_restricted_flexible_seccomp_disabled.yaml
+    asserts:
+      - equal:
+          path: securityContext
+          value:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsUser: 64535
+            runAsGroup: 64535
+            privileged: false
+            runAsNonRoot: true
+            appArmorProfile:
+              type: RuntimeDefault
+  - it: custom appArmorProfile value
+    template: helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_custom.yaml
+    asserts:
+      - equal:
+          path: securityContext.appArmorProfile
+          value:
+            type: Localhost
+            localhostProfile: k8s-apparmor-example-deny-write
+  - it: disable appArmorProfile with empty string
+    template: helm_lib_module_container_security_context_pss_restricted_flexible_apparmor_disabled.yaml
+    asserts:
+      - notExists:
+          path: securityContext.appArmorProfile
diff --git a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml b/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml
deleted file mode 100644
index 6b96afd..0000000
--- a/tests/tests/helm_lib_module_container_security_context_pss_restricted_flexible_test_seccomp_disabled.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-suite: helm_lib_module_container_security_context_pss_restricted_flexible
-templates:
-  - helm_lib_module_container_security_context_pss_restricted_flexible_seccomp_disabled.yaml
-tests:
-  - it: seccompProfile disabled
-    asserts:
-      - equal:
-          path: securityContext
-          value:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsUser: 64535
-            runAsGroup: 64535
-            runAsNonRoot: true
diff --git a/tests/tests/helm_lib_module_init_container_test.yaml b/tests/tests/helm_lib_module_init_container_test.yaml
index d058bf7..ff0942e 100644
--- a/tests/tests/helm_lib_module_init_container_test.yaml
+++ b/tests/tests/helm_lib_module_init_container_test.yaml
@@ -99,6 +99,8 @@ tests:
                   ephemeral-storage: 50Mi
               securityContext:
                 allowPrivilegeEscalation: false
+                appArmorProfile:
+                  type: RuntimeDefault
                 capabilities:
                   drop:
                     - ALL