diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index cf185ec..e2cd203 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -1,19 +1,40 @@
-{{- define "sanitizeEnvVarName" -}}
-{{ regexReplaceAll "[^A-Z0-9]+" (upper .) "_" }}
+{{/*
+Envoy Gateway full name.
+*/}}
+{{- define "envoy.fullname" -}}
+  {{- printf "%s-envoy" .Release.Name -}}
 {{- end -}}
 
 {{/*
-Envoy Gateway full name
+OpenWebUI full name.
 */}}
-{{- define "envoy.fullname" -}}
-  {{- printf "%s-envoy" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- define "openwebui.fullname" -}}
+  {{- printf "%s-openwebui" .Release.Name -}}
 {{- end -}}
 
 {{/*
-Backend name for a specific model
+
+Telemetry full name.
+*/}}
+{{- define "telemetry.fullname" -}}
+  {{- printf "%s-telemetry" .Release.Name -}}
+{{- end -}}
+
+{{/*
+
+Init job full name.
+*/}}
+{{- define "initjob.fullname" -}}
+  {{- printf "%s-init" .Release.Name -}}
+{{- end -}}
+
+{{/*
+Base name for every resource of one model.
+
+Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 */}}
-{{- define "envoy.backendName" -}}
-  {{- printf "%s-%s" (include "envoy.fullname" .) .modelName | trunc 63 | trimSuffix "-" -}}
+{{- define "model.fullname" -}}
+  {{- printf "%s-model-%s" .Release.Name .modelName -}}
 {{- end -}}
 
 {{/*
diff --git a/templates/authentik-blueprints-secret.yaml b/templates/authentik-blueprints-secret.yaml
index 91538e9..da0d0ba 100644
--- a/templates/authentik-blueprints-secret.yaml
+++ b/templates/authentik-blueprints-secret.yaml
@@ -1,7 +1,8 @@
+{{- if and .Values.authentik.enabled .Values.authentik.blueprints.secrets }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: authentik-blueprints
+  name: {{ .Values.authentik.blueprints.secrets | first }}
 type: Opaque
 stringData:
   authentik-config.yaml: |
@@ -112,3 +113,4 @@ stringData:
           domain: authentik-default
         attrs:
           flow_device_code: !Find [authentik_flows.flow, [slug, default-source-pre-authentication]]
+{{- end }}
diff --git a/templates/envoy/ai-gateway-route.yaml b/templates/envoy/ai-gateway-route.yaml
index 208123c..c0c67d1 100644
--- a/templates/envoy/ai-gateway-route.yaml
+++ b/templates/envoy/ai-gateway-route.yaml
@@ -28,7 +28,7 @@ spec:
               name: x-ai-eg-model
               value: {{ $model.fullName }}
       backendRefs:
-        - name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+        - name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- end }}
   {{- end }}
 {{- end }}
diff --git a/templates/envoy/ai-service-backend.yaml b/templates/envoy/ai-service-backend.yaml
index 5146e78..0c2d866 100644
--- a/templates/envoy/ai-service-backend.yaml
+++ b/templates/envoy/ai-service-backend.yaml
@@ -1,11 +1,12 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: AIServiceBackend
 metadata:
-  name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+  name: {{ $fullname }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -15,7 +16,7 @@ spec:
     name: OpenAI
     version: "v1"
   backendRef:
-    name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+    name: {{ $fullname }}
     kind: Backend
     group: gateway.envoyproxy.io
     {{- end }}
diff --git a/templates/envoy/authentik-httproute.yaml b/templates/envoy/authentik-httproute.yaml
index 2cd314f..d142642 100644
--- a/templates/envoy/authentik-httproute.yaml
+++ b/templates/envoy/authentik-httproute.yaml
@@ -1,3 +1,4 @@
+{{- if and .Values.envoy.enabled .Values.authentik.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -16,3 +17,4 @@ spec:
         namespace: {{ .Release.Namespace }}
         port: 80
   
+{{- end }}
diff --git a/templates/envoy/backend-security-policy.yaml b/templates/envoy/backend-security-policy.yaml
index 66cc6a7..2c4933f 100644
--- a/templates/envoy/backend-security-policy.yaml
+++ b/templates/envoy/backend-security-policy.yaml
@@ -1,25 +1,25 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: BackendSecurityPolicy
 metadata:
-  name: backend-security-{{ $name }}
+  name: {{ $fullname }}-security
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
     release: {{ $.Release.Name }}
-    test: test
 spec:
   type: APIKey
   targetRefs:
     - group: aigateway.envoyproxy.io
       kind: AIServiceBackend
-      name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+      name: {{ $fullname }}
   apiKey:
     secretRef:
-      name: vllm-secret-{{ $name }}
+      name: {{ $fullname }}
     {{- end }}
   {{- end }}
 {{- end }}
diff --git a/templates/envoy/backend-traffic-policy.yaml b/templates/envoy/backend-traffic-policy.yaml
index abff37b..095382f 100644
--- a/templates/envoy/backend-traffic-policy.yaml
+++ b/templates/envoy/backend-traffic-policy.yaml
@@ -8,7 +8,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: BackendTrafficPolicy
 metadata:
-  name: model-rate-limit-policy
+  name: {{ include "envoy.fullname" . }}-model-rate-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:
diff --git a/templates/envoy/backend.yaml b/templates/envoy/backend.yaml
index d5ad709..6e63568 100644
--- a/templates/envoy/backend.yaml
+++ b/templates/envoy/backend.yaml
@@ -1,11 +1,12 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: Backend
 metadata:
-  name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+  name: {{ $fullname }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -14,7 +15,7 @@ spec:
   endpoints:
       {{- if $model.internal }}
     - fqdn:
-        hostname: model-{{ $name }}.{{ $.Release.Namespace }}.svc.cluster.local
+        hostname: {{ $fullname }}.{{ $.Release.Namespace }}.svc.cluster.local
         port: 80
       {{- else if $model.apiUrl }}
     - fqdn:
diff --git a/templates/envoy/client-traffic-policy.yaml b/templates/envoy/client-traffic-policy.yaml
index 3493948..0890ab0 100644
--- a/templates/envoy/client-traffic-policy.yaml
+++ b/templates/envoy/client-traffic-policy.yaml
@@ -4,7 +4,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: ClientTrafficPolicy
 metadata:
-  name: client-buffer-limit
+  name: {{ include "envoy.fullname" . }}-client-buffer-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:
diff --git a/templates/envoy/envoy-proxy.yaml b/templates/envoy/envoy-proxy.yaml
index eef8842..683265f 100644
--- a/templates/envoy/envoy-proxy.yaml
+++ b/templates/envoy/envoy-proxy.yaml
@@ -52,7 +52,7 @@ spec:
             - type: OpenTelemetry
               openTelemetry:
                 port: 4317
-                host: "otlp-openmeter-bridge.{{ .Release.Namespace }}.svc.cluster.local"
+                host: "{{ include "telemetry.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
   {{- end }}
   {{- if or .Values.envoy.resources .Values.envoy.service }}
   provider:
diff --git a/templates/envoy/gateway.yaml b/templates/envoy/gateway.yaml
index 8115b5c..ed598c3 100644
--- a/templates/envoy/gateway.yaml
+++ b/templates/envoy/gateway.yaml
@@ -16,6 +16,7 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ include "envoy.fullname" . }}-wildcard-https
+  {{- if .Values.openwebui.enabled }}
     - name: https-openwebui
       protocol: HTTPS
       port: 443
@@ -25,6 +26,8 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ include "envoy.fullname" . }}-wildcard-https
+  {{- end }}
+  {{- if .Values.authentik.enabled }}
     - name: https-authentik
       protocol: HTTPS
       port: 443
@@ -39,4 +42,5 @@ spec:
       group: gateway.envoyproxy.io
       kind: EnvoyProxy
       name: {{ include "envoy.fullname" . }}
+  {{- end }}
 {{- end }}
diff --git a/templates/envoy/openwebui-httproute.yaml b/templates/envoy/openwebui-httproute.yaml
index 09917a8..942353e 100644
--- a/templates/envoy/openwebui-httproute.yaml
+++ b/templates/envoy/openwebui-httproute.yaml
@@ -1,3 +1,4 @@
+{{- if and .Values.envoy.enabled .Values.openwebui.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -12,7 +13,8 @@ spec:
       group: gateway.networking.k8s.io
   rules:
   - backendRefs:
-      - name: openwebui
+      - name: {{ include "openwebui.fullname" . }}
         namespace: {{ .Release.Namespace }}
         port: 8080
   
+{{- end }}
diff --git a/templates/envoy/security-policy.yaml b/templates/envoy/security-policy.yaml
index 93030c6..d535e75 100644
--- a/templates/envoy/security-policy.yaml
+++ b/templates/envoy/security-policy.yaml
@@ -2,7 +2,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: SecurityPolicy
 metadata:
-  name: authentik-jwks
+  name: {{ include "envoy.fullname" . }}-authentik-jwks
   namespace: {{ .Release.Namespace }}
 spec:
   targetRef:
diff --git a/templates/init_job/init_job.yaml b/templates/init_job/init_job.yaml
index 50d2186..ff0e9a3 100644
--- a/templates/init_job/init_job.yaml
+++ b/templates/init_job/init_job.yaml
@@ -1,7 +1,8 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: "{{ .Release.Name }}-init-deployment"
+  name: "{{ include "initjob.fullname" . }}"
   labels:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
@@ -12,7 +13,7 @@ spec:
   backoffLimit: 6
   template:
     metadata:
-      name: "{{.Release.Name}}-init-deployment"
+      name: "{{ include "initjob.fullname" . }}"
       labels:
         heritage: {{ .Release.Service }}
         release: {{ .Release.Name }}
@@ -21,17 +22,17 @@ spec:
       initContainers:
         - name: check-openwebui
           image: alpine/curl:latest
-          command: ["sh", "-c", "until curl -f 'http://openwebui.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
+          command: ["sh", "-c", "until curl -f 'http://{{ include "openwebui.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
       containers:
-        - name: init-deployment
-          image: {{ .Values.initJob.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/init" }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
-          imagePullPolicy: {{ .Values.initJob.image.pullPolicy | default "IfNotPresent" }}
+        - name: init
+          image: {{ .Values.initJob.image.repository }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.initJob.image.pullPolicy }}
           args: ["init"]
           env:
             - name: INIT_OPEN_WEBUI__ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: init-secret
+                  name: {{ include "initjob.fullname" . }}
                   key: OPENWEBUI_ADMIN_PASSWORD
             - name: CONFIG_PATH
               value: /svc/config.toml
@@ -43,14 +44,15 @@ spec:
               cpu: 1
               memory: 2Gi
           volumeMounts:
-            - name: init-secret
+            - name: config
               mountPath: /svc/config.toml
               subPath: config.toml
-{{- with .Values.global.imagePullSecrets }}
+  {{- with .Values.global.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
-{{- end }}
+  {{- end }}
       volumes:
-        - name: init-secret
+        - name: config
           secret:
-            secretName: init-secret
+            secretName: {{ include "initjob.fullname" . }}
+{{- end }}
diff --git a/templates/init_job/init_secret.yaml b/templates/init_job/init_secret.yaml
index 9cb89b6..ebfc551 100644
--- a/templates/init_job/init_secret.yaml
+++ b/templates/init_job/init_secret.yaml
@@ -1,13 +1,15 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: init-secret
+  name: {{ include "initjob.fullname" . }}
 type: Opaque
 stringData:
   config.toml: |
     [open_webui]
-    host = "openwebui.{{ $.Release.Namespace }}.svc.cluster.local:8080"
+    host = "{{ include "openwebui.fullname" . }}.{{ $.Release.Namespace }}.svc.cluster.local:8080"
     admin_user = "{{ .Values.openwebui.admin.user | required ".Values.openwebui.admin.user is required" }}"
     admin_email = "{{ .Values.openwebui.admin.email | required ".Values.openwebui.admin.email is required"}}"
     model_ids = [{{ range $name, $model := .Values.models }}"{{ $model.fullName }}",{{ end }}]
   OPENWEBUI_ADMIN_PASSWORD: {{ .Values.openwebui.admin.password | required ".Values.openwebui.admin.password" | quote }}
+{{- end }}
diff --git a/templates/models/knative-serving.yaml b/templates/models/knative-serving.yaml
index a6423d1..a62356f 100644
--- a/templates/models/knative-serving.yaml
+++ b/templates/models/knative-serving.yaml
@@ -3,6 +3,8 @@
   {{- $persistence := $model.persistence | default dict }}
   {{- $image := $model.image | default dict }}
   {{- $cacheDir := $model.cacheDir | default dict }}
+  {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
+  {{- $cachePath := $cacheDir.path | default "/myhome" }}
   {{- if $model.dummy }}
 ---
 apiVersion: serving.knative.dev/v1
@@ -14,7 +16,7 @@ metadata:
     networking.knative.dev/visibility: cluster-local
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
-  name: model-{{ $name }}
+  name: {{ $fullname }}
 spec:
   template:
     metadata:
@@ -69,11 +71,11 @@ spec:
     {{- end }}
           volumeMounts:
     {{- if $persistence.enabled }}
-          - mountPath: {{ $cacheDir.path | default "/myhome" }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache/
     {{- else if (and $cacheDir $cacheDir.claimName) }}
-          - mountPath: {{ $cacheDir.path }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache
     {{- end }}
@@ -101,7 +103,7 @@ spec:
       volumes:
         - name: pvc-cache
           persistentVolumeClaim:
-            claimName: {{ if $persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
+            claimName: {{ if $persistence.enabled }}{{ $fullname }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
     {{- end }}
   traffic:
     - latestRevision: true
@@ -117,7 +119,7 @@ metadata:
     networking.knative.dev/visibility: cluster-local
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
-  name: model-{{ $name }}
+  name: {{ $fullname }}
 spec:
   template:
     metadata:
@@ -175,11 +177,11 @@ spec:
             - name: VLLM_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: vllm-secret-{{ $name }}
+                  name: {{ $fullname }}
                   key: apiKey
     {{- if or $persistence.enabled $cacheDir }}
             - name: VLLM_CACHE_ROOT
-              value: {{ $cacheDir.path | default "/myhome" }}
+              value: {{ $cachePath }}
     {{- end }}
           startupProbe:
             httpGet:
@@ -217,14 +219,14 @@ spec:
           ports:
             - containerPort: 8000
               protocol: TCP
-          workingDir: {{ $cacheDir.path | default "/myhome" }}
+          workingDir: {{ $cachePath }}
           volumeMounts:
     {{- if $persistence.enabled }}
-          - mountPath: {{ $cacheDir.path | default "/myhome" }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache/
     {{- else if (and $cacheDir $cacheDir.claimName) }}
-          - mountPath: {{ $cacheDir.path }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache
     {{- end }}
@@ -246,7 +248,7 @@ spec:
       volumes:
         - name: pvc-cache
           persistentVolumeClaim:
-            claimName: {{ if $persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
+            claimName: {{ if $persistence.enabled }}{{ $fullname }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
     {{- end }}
       timeoutSeconds: 600
       responseStartTimeoutSeconds: 600
diff --git a/templates/models/model_secret.yaml b/templates/models/model_secret.yaml
index fa04c5f..d6e1743 100644
--- a/templates/models/model_secret.yaml
+++ b/templates/models/model_secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "vllm-secret-{{ $name }}"
+  name: "{{ include "model.fullname" (merge (dict "modelName" $name) $) }}"
   namespace: {{ $.Release.Namespace }}
 type: Opaque
 data:
diff --git a/templates/models/network_policy.yaml b/templates/models/network_policy.yaml
index 52e5d92..0c0c577 100644
--- a/templates/models/network_policy.yaml
+++ b/templates/models/network_policy.yaml
@@ -4,11 +4,12 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: model-{{ $name }}
+  name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 spec:
   podSelector:
     matchLabels:
       app: model-{{ $name }}
+      release: {{ $.Release.Name }}
   policyTypes:
     - Ingress
   ingress:
diff --git a/templates/models/pvc.yaml b/templates/models/pvc.yaml
index 92ce4e8..592b611 100644
--- a/templates/models/pvc.yaml
+++ b/templates/models/pvc.yaml
@@ -1,13 +1,12 @@
 {{- range $name, $model := .Values.models }}
-  {{- /* These sub-maps are optional in values.yaml; default them so a missing
-  key renders empty instead of failing with a nil pointer. */}}
+  {{- /* default optional sub-maps so a missing key does not fail. */}}
   {{- $persistence := $model.persistence | default dict }}
   {{- if and $model.internal $persistence.enabled }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ $.Release.Name }}-model-{{ $name }}-cache
+  name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}-cache
   labels:
     app: model-{{ $name }}
     release: {{ $.Release.Name }}
diff --git a/templates/openwebui/deployment.yaml b/templates/openwebui/deployment.yaml
index c6cf51e..a2fc638 100644
--- a/templates/openwebui/deployment.yaml
+++ b/templates/openwebui/deployment.yaml
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-openwebui
+  name: {{ include "openwebui.fullname" . }}
   labels:
     app: openwebui
     release: {{ .Release.Name }}
@@ -12,10 +12,12 @@ spec:
   selector:
     matchLabels:
       app: openwebui
+      release: {{ .Release.Name }}
   template:
     metadata:
       labels:
         app: openwebui
+        release: {{ .Release.Name }}
     spec:
       containers:
         - name: user-container
@@ -35,7 +37,7 @@ spec:
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: postgres-secret
+                  name: {{ include "openwebui.fullname" . }}-postgres
                   key: OPENWEBUI_DATABASE_URL
             - name: ENABLE_OAUTH_SIGNUP
               value: "true"
@@ -46,7 +48,7 @@ spec:
             - name: OAUTH_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: openwebui-oauth
+                  name: {{ include "openwebui.fullname" . }}-oauth
                   key: OAUTH_CLIENT_SECRET
             - name: OAUTH_ADMIN_ROLES
               value: gateway admins
@@ -116,7 +118,7 @@ spec:
   {{- if .Values.openwebui.persistence.enabled }}
         - name: data
           persistentVolumeClaim:
-            claimName: {{ .Release.Name }}-openwebui-data
+            claimName: {{ include "openwebui.fullname" . }}-data
   {{- else if .Values.openwebui.dataClaimName }}
         - name: data
           persistentVolumeClaim:
diff --git a/templates/openwebui/oauth_secret.yaml b/templates/openwebui/oauth_secret.yaml
index 6faa18f..fbb0d2d 100644
--- a/templates/openwebui/oauth_secret.yaml
+++ b/templates/openwebui/oauth_secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "openwebui-oauth"
+  name: "{{ include "openwebui.fullname" . }}-oauth"
 type: Opaque
 stringData:
   OAUTH_CLIENT_SECRET: {{ .Values.authentik.oauthApp.clientSecret | required ".Values.authentik.oauthApp.clientSecret is required" }}
diff --git a/templates/openwebui/pvc.yaml b/templates/openwebui/pvc.yaml
index 114f0c0..d1a6dc3 100644
--- a/templates/openwebui/pvc.yaml
+++ b/templates/openwebui/pvc.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ .Release.Name }}-openwebui-data
+  name: {{ include "openwebui.fullname" . }}-data
   labels:
     app: openwebui
     release: {{ .Release.Name }}
diff --git a/templates/openwebui/service.yaml b/templates/openwebui/service.yaml
index 738e89b..c9e915f 100644
--- a/templates/openwebui/service.yaml
+++ b/templates/openwebui/service.yaml
@@ -1,7 +1,8 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: v1
 kind: Service
 metadata:
-  name: openwebui
+  name: {{ include "openwebui.fullname" . }}
   labels:
     app: openwebui
     release: {{ .Release.Name }}
@@ -9,9 +10,11 @@ metadata:
 spec:
   selector:
     app: openwebui
+    release: {{ .Release.Name }}
   ports:
     - protocol: TCP
       port: 8080
       targetPort: 8080
       name: http
   type: ClusterIP
+{{- end }}
diff --git a/templates/otlp-openmeter-bridge/configmap.yaml b/templates/otlp-openmeter-bridge/configmap.yaml
index b1a6276..62902a3 100644
--- a/templates/otlp-openmeter-bridge/configmap.yaml
+++ b/templates/otlp-openmeter-bridge/configmap.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: otlp-openmeter-bridge-config
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
diff --git a/templates/otlp-openmeter-bridge/deployment.yaml b/templates/otlp-openmeter-bridge/deployment.yaml
index 0511920..c999984 100644
--- a/templates/otlp-openmeter-bridge/deployment.yaml
+++ b/templates/otlp-openmeter-bridge/deployment.yaml
@@ -2,16 +2,17 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: otlp-openmeter-bridge
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     app: otlp-openmeter-bridge
     release: {{ .Release.Name }}
 spec:
-  replicas: {{ .Values.envoy.telemetry.replicas | default 1 }}
+  replicas: {{ .Values.envoy.telemetry.replicas }}
   selector:
     matchLabels:
       app: otlp-openmeter-bridge
+      release: {{ .Release.Name }}
   template:
     metadata:
       labels:
@@ -24,8 +25,8 @@ spec:
   {{- end }}
       containers:
         - name: bridge
-          image: {{ .Values.envoy.telemetry.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/otlp-openmeter-bridge" }}:{{ .Values.envoy.telemetry.image.tag | default .Chart.AppVersion }}
-          imagePullPolicy: {{ .Values.envoy.telemetry.image.pullPolicy | default "IfNotPresent" }}
+          image: {{ .Values.envoy.telemetry.image.repository }}:{{ .Values.envoy.telemetry.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.envoy.telemetry.image.pullPolicy }}
           ports:
             - containerPort: 4317
               name: grpc
@@ -33,7 +34,7 @@ spec:
             - name: REMOTE_API_URL
               valueFrom:
                 configMapKeyRef:
-                  name: otlp-openmeter-bridge-config
+                  name: {{ include "telemetry.fullname" . }}
                   key: remote-api-url
             - name: GRPC_LISTEN_ADDR
               value: ":4317"
@@ -42,7 +43,7 @@ spec:
             - name: BEARER_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: otlp-openmeter-bridge-secret
+                  name: {{ include "telemetry.fullname" . }}
                   key: bearer-token
           resources:
             {{- toYaml .Values.envoy.telemetry.resources | nindent 12 }}
diff --git a/templates/otlp-openmeter-bridge/secret.yaml b/templates/otlp-openmeter-bridge/secret.yaml
index dad6770..e2a7a8b 100644
--- a/templates/otlp-openmeter-bridge/secret.yaml
+++ b/templates/otlp-openmeter-bridge/secret.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: otlp-openmeter-bridge-secret
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
diff --git a/templates/otlp-openmeter-bridge/service.yaml b/templates/otlp-openmeter-bridge/service.yaml
index 2d48187..015c607 100644
--- a/templates/otlp-openmeter-bridge/service.yaml
+++ b/templates/otlp-openmeter-bridge/service.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: otlp-openmeter-bridge
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     app: otlp-openmeter-bridge
@@ -10,6 +10,7 @@ metadata:
 spec:
   selector:
     app: otlp-openmeter-bridge
+    release: {{ .Release.Name }}
   ports:
     - protocol: TCP
       port: 4317
diff --git a/templates/postgres_secret.yaml b/templates/postgres_secret.yaml
index 2c0ad21..b42e349 100644
--- a/templates/postgres_secret.yaml
+++ b/templates/postgres_secret.yaml
@@ -6,7 +6,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "postgres-secret"
+  name: "{{ include "openwebui.fullname" . }}-postgres"
 type: Opaque
   {{- $pg := .Values.openwebui.postgres }}
   {{- /* One value fills both db and role. */}}
diff --git a/tools/helm/lint-values.yaml b/tools/helm/lint-values.yaml
index 1276334..6f3f8ed 100644
--- a/tools/helm/lint-values.yaml
+++ b/tools/helm/lint-values.yaml
@@ -1,4 +1,6 @@
-# Dummy values so `helm template` (just lint) can render required fields.
+envoy:
+  telemetry:
+    enabled: true
 authentik:
   authentik:
     postgresql:
@@ -13,5 +15,17 @@ openwebui:
   postgres:
     host: pg.example.invalid
     password: dummy
-initJob:
-  image: {}
+models:
+  lint: &model
+    fullName: org/lint-model
+    internal: true
+    apiKey: dummy
+    persistence: { enabled: true } # renders models/pvc.yaml and the chart-owned claim
+    resources:
+      requests: { cpu: 1, memory: 1G }
+      limits: { cpu: 2, memory: 2G }
+  # exercises the external-claim branch (persistence off, no cacheDir.path)
+  lint-byoc:
+    <<: *model
+    persistence: { enabled: false }
+    cacheDir: { claimName: pvc-example-home }
diff --git a/tools/just/helm.just b/tools/just/helm.just
index 0aed117..88a56bf 100644
--- a/tools/just/helm.just
+++ b/tools/just/helm.just
@@ -31,7 +31,7 @@ template *args: fetch-deps
     #!/usr/bin/env bash
     set -eu
     cd "{{root_dir}}"
-    helm template . "$@"
+    helm template "$@" .
 
 # Package the chart for a release tag (e.g. v0.3.0) and push it to GHCR as an OCI artifact.
 publish tag: fetch-deps
diff --git a/values.yaml b/values.yaml
index f7acc61..2a464dd 100644
--- a/values.yaml
+++ b/values.yaml
@@ -94,6 +94,7 @@ authentik:
     bootstrapPassword:
     bootstrapToken:
   blueprints:
+    # Override when two releases share a namespace.
     secrets:
       - authentik-blueprints
   server: