diff --git a/helm/templates/configmap.yaml b/helm/templates/configmap.yaml
index 5272399..678f8d8 100644
--- a/helm/templates/configmap.yaml
+++ b/helm/templates/configmap.yaml
@@ -5,7 +5,6 @@ kind: ConfigMap
 metadata:
   name: {{ .Release.Name }}-{{ $chartName }}-configmap
 data:
-  # NODE_TLS_REJECT_UNAUTHORIZED: '0'
   AWS_ENDPOINT_URL: {{ .Values.s3.url | quote }}
   AWS_BUCKET: {{ .Values.s3.bucket | quote }}
   AWS_REGION: {{ .Values.s3.region | quote }}
@@ -24,5 +23,4 @@ data:
   AGENT_ALLOWED_ORIGIN: {{ . | quote }}
   {{- end }}
   npm_config_cache: /tmp/
-  # default.conf: {{ tpl (.Files.Get "config/default.conf") . | quote }}
 {{- end }}
diff --git a/helm/templates/deployment.yaml b/helm/templates/deployment.yaml
index a7b4b04..873691c 100644
--- a/helm/templates/deployment.yaml
+++ b/helm/templates/deployment.yaml
@@ -55,8 +55,10 @@ spec:
           env:
             - name: NODE_OPTIONS
               value: 'no-network-family-autoselection'
-            - name: NODE_TLS_REJECT_UNAUTHORIZED
-              value: '0'
+            {{- if .Values.global.ca.secretName }}
+            - name: NODE_EXTRA_CA_CERTS
+              value: '/usr/local/share/ca-certificates/ca.crt'
+            {{- end }}
           envFrom:
             - configMapRef:
                 name: {{ $releaseName }}-{{ $chartName }}-configmap
@@ -70,24 +72,35 @@ spec:
             - name: http
               containerPort: 8080
               protocol: TCP
-          livenessProbe:
+          startupProbe:
             initialDelaySeconds: {{ .Values.initialDelaySeconds }}
             httpGet:
               path: /
               port: 8080
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 8080
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8080
           {{- if .Values.resources.enabled }}
           resources:
             {{- toYaml .Values.resources.value | nindent 12 }}
           {{- end }}
-          # volumeMounts:
-          #   - name: nginx-config
-          #     mountPath: /etc/nginx/conf.d/default.conf
-          #     subPath: default.conf
-      # volumes:
-      #   - name: nginx-config
-      #     configMap:
-      #       name: {{ $releaseName }}-{{ $chartName }}-configmap
-      #       items:
-      #         - key: default.conf
-      #           path: default.conf
+          {{- if .Values.global.ca.secretName }}
+          volumeMounts:
+            - name: root-ca
+              mountPath: '/usr/local/share/ca-certificates/ca.crt'
+              subPath: 'ca.crt'
+          {{- end }}
+      {{- if .Values.global.ca.secretName }}
+      volumes:
+        - name: root-ca
+          secret:
+            secretName: {{ .Values.global.ca.secretName }}
+      {{- end }}
 {{- end -}}
diff --git a/helm/values.yaml b/helm/values.yaml
index 92f348a..9798f82 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -1,6 +1,9 @@
 global:
   cloudProvider: {}
   environment: {}
+  # Pre-existing Secret (ca.crt key) trusted for outbound TLS; '' disables.
+  ca:
+    secretName: 'root-ca'
 enabled: true
 environment: development
 replicaCount: 1
@@ -37,9 +40,7 @@ s3:
   url: 'http://localhost:9000'
   bucket: 'temp'
   region: 'us-east-1'
-  # Provide credentials via an existing Secret (must expose AWS_ACCESS_KEY_ID and
-  # AWS_SECRET_ACCESS_KEY). Leave empty to have the chart create the Secret from the
-  # accessKeyId/secretAccessKey values below.
+  # Existing Secret with AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY; '' creates one below.
   existingSecret: ''
   accessKeyId: 'user'
   secretAccessKey: 'password'
@@ -49,7 +50,6 @@ items:
   timeout: 600
   stale: 600
 
-# Public navigation links exposed to the browser.
 links:
   catalogHref: 'http://catalog'
   devPortalHref: 'http://developer-portal'
@@ -58,17 +58,16 @@ links:
 cache:
   debounceMs: 500
 
-# Agent chat panel (LiteLLM-backed). Dark unless enabled=true.
+# Agent chat panel; dark unless enabled.
 agent:
   enabled: false
   model: inclusionai/ling-3.0-flash:free
   developerPortalUrl: 'http://developer-portal'
-  # Optional: expected browser Origin for /api/agent behind a proxy. Empty = app origin.
+  # Override expected browser Origin for /api/agent behind a proxy; '' = app origin.
   allowedOrigin: ''
   litellm:
     baseUrl: 'http://litellm:4000'
-    # Provide the key via an existing Secret (must expose LITELLM_API_KEY). Leave empty
-    # to have the chart create the Secret from apiKey below.
+    # Existing Secret with LITELLM_API_KEY; '' creates one from apiKey below.
     existingSecret: ''
     apiKey: ''