diff --git a/ansible/HAL_deploy.yml b/ansible/HAL_deploy.yml
index 64bdf640..1219f9df 100644
--- a/ansible/HAL_deploy.yml
+++ b/ansible/HAL_deploy.yml
@@ -144,7 +144,6 @@
   roles:
     - {role: k3s-install, tags: k3s-install}
     - {role: tsg-os-provision, tags: tsg-os-provision}
-    - {role: tsg_device_tag, tags: tsg_device_tag}
     - {role: tsg_sn, tags: tsg_sn}
     - {role: framework, tags: framework}
     - {role: mrzcpd, tags: mrzcpd}
diff --git a/ansible/roles/traffic-engine/files/helm/conf/maat.conf b/ansible/roles/traffic-engine/files/helm/conf/maat.conf
index 8d39ee02..560d3d62 100644
--- a/ansible/roles/traffic-engine/files/helm/conf/maat.conf
+++ b/ansible/roles/traffic-engine/files/helm/conf/maat.conf
@@ -61,4 +61,4 @@ FULL_CFG_DIR=tsgrule/full/index/
 EFFECTIVE_RANGE_FILE=/opt/tsg/etc/tsg_device_tag.json
 
 [MAAT]
-DEVICE_TAGS={"tags":[{{- include "traffic-engine.device-tag-list" . }}]}
+ACCEPT_TAGS={"tags":[{{- include "traffic-engine.device-tag-list" . }}]}
diff --git a/ansible/roles/traffic-engine/files/helm/conf/tsg_device_tag.json b/ansible/roles/traffic-engine/files/helm/conf/tsg_device_tag.json
new file mode 100644
index 00000000..712583ed
--- /dev/null
+++ b/ansible/roles/traffic-engine/files/helm/conf/tsg_device_tag.json
@@ -0,0 +1,2 @@
+[MAAT]
+ACCEPT_TAGS={"tags":[{{- include "traffic-engine.device-tag-list" . }}]}
diff --git a/ansible/roles/traffic-engine/files/helm/templates/certstore.yaml b/ansible/roles/traffic-engine/files/helm/templates/certstore.yaml
index ad707c37..5588ded8 100644
--- a/ansible/roles/traffic-engine/files/helm/templates/certstore.yaml
+++ b/ansible/roles/traffic-engine/files/helm/templates/certstore.yaml
@@ -5,3 +5,4 @@ metadata:
   namespace: default
 data:
   cert_store.ini: {{ tpl (.Files.Get "conf/cert_store.ini") . | quote }}
+  tsg_device_tag.json: {{ tpl (.Files.Get "conf/tsg_device_tag.json") . | quote }}
diff --git a/ansible/roles/traffic-engine/files/helm/templates/sapp.yaml b/ansible/roles/traffic-engine/files/helm/templates/sapp.yaml
index fb439c4a..58d6dd45 100644
--- a/ansible/roles/traffic-engine/files/helm/templates/sapp.yaml
+++ b/ansible/roles/traffic-engine/files/helm/templates/sapp.yaml
@@ -15,3 +15,4 @@ data:
   wangw.conf: {{ tpl (.Files.Get "conf/wangw.conf") . | quote }}
   wire_graft.conf: {{ tpl (.Files.Get "conf/wire_graft.conf") . | quote }}
   vlan_flipping_map.conf: {{ tpl (.Files.Get "conf/vlan_flipping_map.conf") . | quote }}
+  tsg_device_tag.json: {{ tpl (.Files.Get "conf/tsg_device_tag.json") . | quote }}
diff --git a/ansible/roles/traffic-engine/files/helm/templates/tfe.yaml b/ansible/roles/traffic-engine/files/helm/templates/tfe.yaml
index 2a8b34dd..c6f5e7e5 100644
--- a/ansible/roles/traffic-engine/files/helm/templates/tfe.yaml
+++ b/ansible/roles/traffic-engine/files/helm/templates/tfe.yaml
@@ -6,3 +6,4 @@ metadata:
 data:
   tfe.conf: {{ tpl (.Files.Get "conf/tfe.conf") . | quote }}
   pangu_pxy.conf: {{ tpl (.Files.Get "conf/pangu_pxy.conf") . | quote }}
+  tsg_device_tag.json: {{ tpl (.Files.Get "conf/tsg_device_tag.json") . | quote }}
diff --git a/ansible/roles/traffic-engine/files/helm/templates/traffic-engine.yaml b/ansible/roles/traffic-engine/files/helm/templates/traffic-engine.yaml
index e466b2c9..13d2d545 100644
--- a/ansible/roles/traffic-engine/files/helm/templates/traffic-engine.yaml
+++ b/ansible/roles/traffic-engine/files/helm/templates/traffic-engine.yaml
@@ -86,6 +86,9 @@ spec:
         - name: sapp
           mountPath: "/opt/tsg/sapp/etc/vlan_flipping_map.conf"
           subPath: "vlan_flipping_map.conf"
+        - name: sapp
+          mountPath: "/opt/tsg/etc/tsg_device_tag.json"
+          subPath: "tsg_device_tag.json"
         - name: config-volume
           mountPath: "/opt/tsg/etc/tsg_sn.json"
           subPath: "opt/tsg/etc/tsg_sn.json"
@@ -119,6 +122,9 @@ spec:
         - name: tfe
           mountPath: "/opt/tsg/tfe/conf/pangu/pangu_pxy.conf"
           subPath: "pangu_pxy.conf"
+        - name: tfe
+          mountPath: "/opt/tsg/etc/tsg_device_tag.json"
+          subPath: "tsg_device_tag.json"
         - name: config-volume
           mountPath: "/opt/tsg/etc/tsg_sn.json"
           subPath: "opt/tsg/etc/tsg_sn.json"
@@ -139,6 +145,9 @@ spec:
         - name: certstore
           mountPath: "/opt/tsg/certstore/conf/cert_store.ini"
           subPath: "cert_store.ini"
+        - name: certstore
+          mountPath: "/opt/tsg/etc/tsg_device_tag.json"
+          subPath: "tsg_device_tag.json"
         - name: config-volume
           mountPath: "/opt/tsg/etc/tsg_sn.json"
           subPath: "opt/tsg/etc/tsg_sn.json"