diff --git a/apache-tika/Chart.yaml b/apache-tika/Chart.yaml
index 0f6bfb0..695a4c3 100644
--- a/apache-tika/Chart.yaml
+++ b/apache-tika/Chart.yaml
@@ -5,5 +5,5 @@ icon: https://www.apache.org/logos/res/tika/default.png
 
 type: application
 
-version: 7.1.2+up3.3.1.0.full
+version: 7.2.0+up3.3.1.0.full
 appVersion: "3.3.1.0-full"
diff --git a/apache-tika/templates/apache-tika.deployment.yaml b/apache-tika/templates/apache-tika.deployment.yaml
index cc595e8..dabd39f 100644
--- a/apache-tika/templates/apache-tika.deployment.yaml
+++ b/apache-tika/templates/apache-tika.deployment.yaml
@@ -22,6 +22,29 @@ spec:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "apache/tika:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          {{- if .Values.tika.env }}
+          env:
+            {{- range $value := .Values.tika.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+          {{- end }}
           securityContext:
             {{- toYaml .Values.tika.securityContext.container | nindent 12 }}
           volumeMounts:
diff --git a/apache-tika/values.yaml b/apache-tika/values.yaml
index 5517bd5..2a7022b 100644
--- a/apache-tika/values.yaml
+++ b/apache-tika/values.yaml
@@ -45,6 +45,9 @@ tika:
     periodSeconds: 5
     timeoutSeconds: 5
     failureThreshold: 30
+  # Extra environment variables. Values are rendered through tpl; value,
+  # secretKeyRef and configMapKeyRef forms are supported.
+  env: []
   resources:
     # Limits are optional: memory and ephemeral-storage limits default to
     # limitFactor x the request, an explicitly set limit always wins, and a
diff --git a/ci/outline/test-values.yaml b/ci/outline/test-values.yaml
index e75b9f2..b9397ee 100644
--- a/ci/outline/test-values.yaml
+++ b/ci/outline/test-values.yaml
@@ -5,3 +5,6 @@ secrets:
 
 ingress:
   domain: outline.ci.local
+  # clusterIssuer is strictly required (no default); the Ingress just has to
+  # apply - there is no cert-manager in the CI cluster.
+  clusterIssuer: ci
diff --git a/ci/paperless-ngx/test-values.yaml b/ci/paperless-ngx/test-values.yaml
index ad87c80..3769628 100644
--- a/ci/paperless-ngx/test-values.yaml
+++ b/ci/paperless-ngx/test-values.yaml
@@ -5,6 +5,9 @@ secrets:
 
 ingress:
   domain: paperless.ci.local
+  # clusterIssuer is strictly required (no default); the Ingress just has to
+  # apply - there is no cert-manager in the CI cluster.
+  clusterIssuer: ci
 
 # smbConnection and oidc stay disabled (defaults): the SMB CSI driver and a
 # real OIDC login flow are out of scope for the CI install-test.
diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml
index 7cd0cf0..59bc61a 100644
--- a/cyberchef/Chart.yaml
+++ b/cyberchef/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima
 
 type: application
 
-version: 5.1.0+up11.4.0
+version: 5.2.0+up11.4.0
 appVersion: "11.4.0"
 
 maintainers:
diff --git a/cyberchef/templates/cyberchef.deployment.yaml b/cyberchef/templates/cyberchef.deployment.yaml
index 25cb41c..aac23d8 100644
--- a/cyberchef/templates/cyberchef.deployment.yaml
+++ b/cyberchef/templates/cyberchef.deployment.yaml
@@ -22,6 +22,29 @@ spec:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "ghcr.io/gchq/cyberchef:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          {{- if .Values.cyberchef.env }}
+          env:
+            {{- range $value := .Values.cyberchef.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+          {{- end }}
           securityContext:
             {{- toYaml .Values.cyberchef.securityContext.container | nindent 12 }}
           volumeMounts:
diff --git a/cyberchef/values.yaml b/cyberchef/values.yaml
index 2d47606..0796648 100644
--- a/cyberchef/values.yaml
+++ b/cyberchef/values.yaml
@@ -45,6 +45,9 @@ cyberchef:
     periodSeconds: 5
     timeoutSeconds: 5
     failureThreshold: 30
+  # Extra environment variables. Values are rendered through tpl; value,
+  # secretKeyRef and configMapKeyRef forms are supported.
+  env: []
   resources:
     # Limits are optional: memory and ephemeral-storage limits default to
     # limitFactor x the request, an explicitly set limit always wins, and a
diff --git a/gotenberg/Chart.yaml b/gotenberg/Chart.yaml
index 2460bca..a9df3af 100644
--- a/gotenberg/Chart.yaml
+++ b/gotenberg/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://gotenberg.dev/img/logo.png
 
 type: application
 
-version: 4.1.2+up8.36.0
+version: 4.2.0+up8.36.0
 appVersion: "8.36.0"
 
 maintainers:
diff --git a/gotenberg/templates/gotenberg.deployment.yaml b/gotenberg/templates/gotenberg.deployment.yaml
index 341bcc7..481ce38 100644
--- a/gotenberg/templates/gotenberg.deployment.yaml
+++ b/gotenberg/templates/gotenberg.deployment.yaml
@@ -22,6 +22,29 @@ spec:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "gotenberg/gotenberg:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
+          {{- if .Values.gotenberg.env }}
+          env:
+            {{- range $value := .Values.gotenberg.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+          {{- end }}
           securityContext:
             {{- toYaml .Values.gotenberg.securityContext.container | nindent 12 }}
           volumeMounts:
diff --git a/gotenberg/values.yaml b/gotenberg/values.yaml
index 758183a..c24d95b 100644
--- a/gotenberg/values.yaml
+++ b/gotenberg/values.yaml
@@ -46,6 +46,9 @@ gotenberg:
     periodSeconds: 5
     timeoutSeconds: 5
     failureThreshold: 30
+  # Extra environment variables. Values are rendered through tpl; value,
+  # secretKeyRef and configMapKeyRef forms are supported.
+  env: []
   resources:
     # Limits are optional: memory and ephemeral-storage limits default to
     # limitFactor x the request, an explicitly set limit always wins, and a
diff --git a/homeassistant/Chart.yaml b/homeassistant/Chart.yaml
index dc5f109..fcc96cb 100644
--- a/homeassistant/Chart.yaml
+++ b/homeassistant/Chart.yaml
@@ -4,7 +4,7 @@ description: A Helm chart to deploy Home Assistant on Kubernetes
 icon: https://www.home-assistant.io/images/home-assistant-logo.svg
 type: application
 
-version: 4.1.2+up2026.8.3
+version: 4.2.0+up2026.8.3
 
 appVersion: "2026.8.3"
 
diff --git a/homeassistant/templates/homeassistant.ingress.yaml b/homeassistant/templates/homeassistant.ingress.yaml
index 7bff858..598d899 100644
--- a/homeassistant/templates/homeassistant.ingress.yaml
+++ b/homeassistant/templates/homeassistant.ingress.yaml
@@ -10,7 +10,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress.className }}
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
   {{- if .Values.ingress.tls }}
   tls:
     {{- range .Values.ingress.tls }}
diff --git a/homeassistant/templates/homeassistant.sfs.yaml b/homeassistant/templates/homeassistant.sfs.yaml
index 6e7d7b9..42aa274 100644
--- a/homeassistant/templates/homeassistant.sfs.yaml
+++ b/homeassistant/templates/homeassistant.sfs.yaml
@@ -28,6 +28,26 @@ spec:
           env:
             - name: TZ
               value: "{{ .Values.core.timezone }}"
+            {{- range $value := .Values.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 8123
diff --git a/homeassistant/values.yaml b/homeassistant/values.yaml
index dbf5796..c252504 100644
--- a/homeassistant/values.yaml
+++ b/homeassistant/values.yaml
@@ -18,7 +18,8 @@ service:
 # This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
 ingress:
   enabled: false
-  className: ""
+  # Ingress class; set to "" to omit ingressClassName from the rendered Ingress.
+  className: nginx
   annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
@@ -87,6 +88,11 @@ startupProbe:
   timeoutSeconds: 5
   failureThreshold: 30
 
+# Extra environment variables, appended to the ones the chart always sets.
+# Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
+# forms are supported.
+env: []
+
 # Additional volumes on the output Deployment definition.
 volumes: []
 # - name: foo
diff --git a/outline/Chart.yaml b/outline/Chart.yaml
index 560bc7b..07a792a 100644
--- a/outline/Chart.yaml
+++ b/outline/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/outline/outline/main/public/images/icon-
 
 type: application
 
-version: 4.0.0+up1.9.2
+version: 5.0.0+up1.9.2
 appVersion: 1.9.2
 
 maintainers:
diff --git a/outline/values.yaml b/outline/values.yaml
index dd2e7a9..fdc56d4 100644
--- a/outline/values.yaml
+++ b/outline/values.yaml
@@ -81,7 +81,7 @@ outline:
 ingress:
   enabled: true
   maxUploadFileSize: 25m
-  clusterIssuer: letsencrypt
+  clusterIssuer: null
   domain: null
   className: nginx
   # Extra annotations for the Ingress; merged with the cert-manager
diff --git a/paperless-ngx/Chart.yaml b/paperless-ngx/Chart.yaml
index c8acbb4..d87db47 100644
--- a/paperless-ngx/Chart.yaml
+++ b/paperless-ngx/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/dev/src-ui/s
 
 type: application
 
-version: 9.0.0+up3.0.5
+version: 10.0.0+up3.0.5
 
 appVersion: 3.0.5
 
diff --git a/paperless-ngx/values.yaml b/paperless-ngx/values.yaml
index 5d41c59..08ae837 100644
--- a/paperless-ngx/values.yaml
+++ b/paperless-ngx/values.yaml
@@ -12,7 +12,7 @@ secrets:
   oidcSecretRef: null
 
 ingress:
-  clusterIssuer: "letsencrypt-issuer"
+  clusterIssuer: null
   domain: null
   className: nginx
   # Extra annotations for the Ingress; merged with the cert-manager
diff --git a/patchmon/Chart.yaml b/patchmon/Chart.yaml
index 229fd99..8c77df2 100644
--- a/patchmon/Chart.yaml
+++ b/patchmon/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/PatchMon/PatchMon/main/frontend/public/a
 
 type: application
 
-version: 5.1.0+up2.1.3
+version: 5.2.0+up2.1.3
 appVersion: "2.1.3"
 
 maintainers:
diff --git a/patchmon/templates/patchmon.deployment.yaml b/patchmon/templates/patchmon.deployment.yaml
index 669298b..1f8436e 100644
--- a/patchmon/templates/patchmon.deployment.yaml
+++ b/patchmon/templates/patchmon.deployment.yaml
@@ -143,6 +143,26 @@ spec:
             - name: GUACD_ADDRESS
               value: "127.0.0.1:4822"
             {{- end }}
+            {{- range $value := .Values.patchmon.server.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           # Probe values are rendered through tpl (see values.yaml for the
           # defaults and why the probes send a Host header).
           livenessProbe:
@@ -162,6 +182,29 @@ spec:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-guacd
           image: {{ .Values.patchmon.guacd.image }}
           imagePullPolicy: IfNotPresent
+          {{- if .Values.patchmon.guacd.env }}
+          env:
+            {{- range $value := .Values.patchmon.guacd.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+          {{- end }}
           securityContext:
             {{- toYaml .Values.patchmon.guacd.securityContext.container | nindent 12 }}
           ports:
diff --git a/patchmon/values.yaml b/patchmon/values.yaml
index 3423e3d..30530ec 100644
--- a/patchmon/values.yaml
+++ b/patchmon/values.yaml
@@ -77,6 +77,10 @@ patchmon:
       periodSeconds: 10
       timeoutSeconds: 5
       failureThreshold: 60
+    # Extra environment variables, appended to the ones the chart always sets.
+    # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
+    # forms are supported.
+    env: []
   guacd:
     # In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon,
     # run as a sidecar container in the server pod. Disabled by default; when
@@ -126,6 +130,10 @@ patchmon:
       periodSeconds: 5
       timeoutSeconds: 5
       failureThreshold: 30
+    # Extra environment variables for the guacd sidecar (e.g. GUACD_LOG_LEVEL).
+    # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
+    # forms are supported.
+    env: []
 
 ingress:
   clusterIssuer: null