diff --git a/bin/k8s/Chart.lock b/bin/k8s/Chart.lock
new file mode 100644
index 00000000000..1871bdcf842
--- /dev/null
+++ b/bin/k8s/Chart.lock
@@ -0,0 +1,21 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 16.5.6
+- name: minio
+  repository: https://charts.bitnami.com/bitnami
+  version: 15.0.7
+- name: lakefs
+  repository: https://charts.lakefs.io
+  version: 1.8.1
+- name: gateway-helm
+  repository: oci://docker.io/envoyproxy
+  version: 1.6.3
+- name: lakekeeper
+  repository: https://lakekeeper.github.io/lakekeeper-charts/
+  version: 0.9.0
+- name: metrics-server
+  repository: https://kubernetes-sigs.github.io/metrics-server/
+  version: 3.12.2
+digest: sha256:6e6c03812902f93980b70506fad66e9b3182d2adeaafaa4eace46f3170bdbe00
+generated: "2026-08-19T12:19:20.413392713-07:00"
diff --git a/bin/k8s/templates/aws/s3-credentials-secret.yaml b/bin/k8s/templates/aws/s3-credentials-secret.yaml
index 8506115167b..771c9c3bf9f 100644
--- a/bin/k8s/templates/aws/s3-credentials-secret.yaml
+++ b/bin/k8s/templates/aws/s3-credentials-secret.yaml
@@ -23,7 +23,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Release.Name }}-s3-credentials
+  name: texera-s3-credentials
   namespace: {{ .Release.Namespace }}
 type: Opaque
 stringData:
diff --git a/bin/k8s/templates/base/_helpers.tpl b/bin/k8s/templates/base/_helpers.tpl
index e044b7285a8..440d3c7139f 100644
--- a/bin/k8s/templates/base/_helpers.tpl
+++ b/bin/k8s/templates/base/_helpers.tpl
@@ -17,14 +17,33 @@ specific language governing permissions and limitations
 under the License.
 */}}
 
+{{/*
+Sub-chart resource names.
+
+The postgresql and minio sub-charts are pinned to fixed names via
+fullnameOverride in values.yaml, because sibling sub-charts (lakefs,
+lakekeeper) must address them from *their own* values -- and Helm does not
+template values files, so those references cannot be release-derived. These
+helpers resolve the same name the sub-chart itself computes, falling back to
+the default "<release>-<chart>" when the override is cleared.
+*/}}
+
+{{- define "texera.postgresql.fullname" -}}
+{{- .Values.postgresql.fullnameOverride | default (printf "%s-postgresql" .Release.Name) -}}
+{{- end -}}
+
+{{- define "texera.minio.fullname" -}}
+{{- .Values.minio.fullnameOverride | default (printf "%s-minio" .Release.Name) -}}
+{{- end -}}
+
 {{/*
 Object-storage (S3) resolution helpers.
 
 When storage.s3.endpoint is set the services talk to that external
-S3-compatible store (credentials come from storage.s3.existingSecret, or a
-chart-generated "<release>-s3-credentials" Secret). When it is empty the
-services fall back to the in-cluster MinIO Service and its auto-generated
-"<release>-minio" Secret, so the default install is unchanged.
+S3-compatible store (credentials come from storage.s3.existingSecret, or the
+chart-generated "texera-s3-credentials" Secret). When it is empty the services
+fall back to the in-cluster MinIO Service and its auto-generated Secret, so the
+default install is unchanged.
 */}}
 
 {{/* S3 endpoint URL. */}}
@@ -32,16 +51,16 @@ services fall back to the in-cluster MinIO Service and its auto-generated
 {{- if .Values.storage.s3.endpoint -}}
 {{- .Values.storage.s3.endpoint -}}
 {{- else -}}
-{{- printf "http://%s-minio:9000" .Release.Name -}}
+{{- printf "http://%s:9000" (include "texera.minio.fullname" .) -}}
 {{- end -}}
 {{- end -}}
 
 {{/* Name of the Secret holding the S3 credentials. */}}
 {{- define "texera.s3.secretName" -}}
 {{- if .Values.storage.s3.endpoint -}}
-{{- .Values.storage.s3.existingSecret | default (printf "%s-s3-credentials" .Release.Name) -}}
+{{- .Values.storage.s3.existingSecret | default "texera-s3-credentials" -}}
 {{- else -}}
-{{- printf "%s-minio" .Release.Name -}}
+{{- include "texera.minio.fullname" . -}}
 {{- end -}}
 {{- end -}}
 
diff --git a/bin/k8s/templates/base/access-control-service/access-control-service-deployment.yaml b/bin/k8s/templates/base/access-control-service/access-control-service-deployment.yaml
index 99713e70713..95808b41fe5 100644
--- a/bin/k8s/templates/base/access-control-service/access-control-service-deployment.yaml
+++ b/bin/k8s/templates/base/access-control-service/access-control-service-deployment.yaml
@@ -40,11 +40,11 @@ spec:
             - containerPort: {{ .Values.accessControlService.service.port }}
           env:
             - name: STORAGE_JDBC_URL
-              value: jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/texera_db?currentSchema=texera_db,public
+              value: jdbc:postgresql://{{ include "texera.postgresql.fullname" . }}:5432/texera_db?currentSchema=texera_db,public
             - name: STORAGE_JDBC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgresql
+                  name: {{ include "texera.postgresql.fullname" . }}
                   key: postgres-password
             - name: KUBERNETES_COMPUTE_UNIT_POOL_NAME
               value: {{ .Values.workflowComputingUnitPool.name }}
diff --git a/bin/k8s/templates/base/config-service/config-service-deployment.yaml b/bin/k8s/templates/base/config-service/config-service-deployment.yaml
index f0748785c3a..4eb400efb84 100644
--- a/bin/k8s/templates/base/config-service/config-service-deployment.yaml
+++ b/bin/k8s/templates/base/config-service/config-service-deployment.yaml
@@ -41,11 +41,11 @@ spec:
           env:
             # TexeraDB Access
             - name: STORAGE_JDBC_URL
-              value: jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/texera_db?currentSchema=texera_db,public
+              value: jdbc:postgresql://{{ include "texera.postgresql.fullname" . }}:5432/texera_db?currentSchema=texera_db,public
             - name: STORAGE_JDBC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgresql
+                  name: {{ include "texera.postgresql.fullname" . }}
                   key: postgres-password
             {{- range .Values.texeraEnvVars }}
             - name: {{ .name }}
diff --git a/bin/k8s/templates/base/external-names/external-names.yaml b/bin/k8s/templates/base/external-names/external-names.yaml
index 6879b8d7f7e..629cf0789aa 100644
--- a/bin/k8s/templates/base/external-names/external-names.yaml
+++ b/bin/k8s/templates/base/external-names/external-names.yaml
@@ -60,9 +60,9 @@ to access services in the main namespace using the same service names.
 ---
 {{/* PostgreSQL ExternalName */}}
 {{- include "external-name-service" (dict 
-  "name" (printf "%s-postgresql" .Release.Name)
+  "name" (include "texera.postgresql.fullname" .)
   "namespace" $workflowComputingUnitPoolNamespace
-  "externalName" (printf "%s-postgresql.%s.svc.cluster.local" .Release.Name $namespace)
+  "externalName" (printf "%s.%s.svc.cluster.local" (include "texera.postgresql.fullname" .) $namespace)
 ) | nindent 0 }}
 
 ---
@@ -78,9 +78,9 @@ to access services in the main namespace using the same service names.
 {{/* MinIO ExternalName -- only when the in-cluster MinIO is enabled; with an
      external S3 store the CU pods reach it directly via STORAGE_S3_ENDPOINT. */}}
 {{- include "external-name-service" (dict
-  "name" (printf "%s-minio" .Release.Name)
+  "name" (include "texera.minio.fullname" .)
   "namespace" $workflowComputingUnitPoolNamespace
-  "externalName" (printf "%s-minio.%s.svc.cluster.local" .Release.Name $namespace)
+  "externalName" (printf "%s.%s.svc.cluster.local" (include "texera.minio.fullname" .) $namespace)
 ) | nindent 0 }}
 {{- end }}
 
diff --git a/bin/k8s/templates/base/file-service/file-service-deployment.yaml b/bin/k8s/templates/base/file-service/file-service-deployment.yaml
index 6a9190bc6cf..4844dad93f8 100644
--- a/bin/k8s/templates/base/file-service/file-service-deployment.yaml
+++ b/bin/k8s/templates/base/file-service/file-service-deployment.yaml
@@ -70,11 +70,11 @@ spec:
                   key: secret_key
             # TexeraDB Access
             - name: STORAGE_JDBC_URL
-              value: jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/texera_db?currentSchema=texera_db,public
+              value: jdbc:postgresql://{{ include "texera.postgresql.fullname" . }}:5432/texera_db?currentSchema=texera_db,public
             - name: STORAGE_JDBC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgresql
+                  name: {{ include "texera.postgresql.fullname" . }}
                   key: postgres-password
             {{- range .Values.texeraEnvVars }}
             - name: {{ .name }}
diff --git a/bin/k8s/templates/base/litellm/litellm-deployment.yaml b/bin/k8s/templates/base/litellm/litellm-deployment.yaml
index ba681da7d16..470c8e9cfdc 100644
--- a/bin/k8s/templates/base/litellm/litellm-deployment.yaml
+++ b/bin/k8s/templates/base/litellm/litellm-deployment.yaml
@@ -53,7 +53,7 @@ spec:
             # model config there, so state survives pod restarts. Defaults to the
             # in-cluster Postgres; set litellm.databaseUrl to point at an external one.
             - name: DATABASE_URL
-              value: {{ .Values.litellm.databaseUrl | default (printf "postgresql://postgres:%s@%s-postgresql:5432/%s" .Values.postgresql.auth.postgresPassword .Release.Name .Values.litellm.databaseName) | quote }}
+              value: {{ .Values.litellm.databaseUrl | default (printf "postgresql://postgres:%s@%s:5432/%s" .Values.postgresql.auth.postgresPassword (include "texera.postgresql.fullname" .) .Values.litellm.databaseName) | quote }}
             - name: STORE_MODEL_IN_DB
               value: "{{ .Values.litellm.storeModelInDb }}"
             {{- range $key, $value := .Values.litellm.providerApiKeys }}
diff --git a/bin/k8s/templates/base/webserver/webserver-deployment.yaml b/bin/k8s/templates/base/webserver/webserver-deployment.yaml
index 983c6269947..22d6d0dd0da 100644
--- a/bin/k8s/templates/base/webserver/webserver-deployment.yaml
+++ b/bin/k8s/templates/base/webserver/webserver-deployment.yaml
@@ -41,11 +41,11 @@ spec:
           env:
             # TexeraDB Access
             - name: STORAGE_JDBC_URL
-              value: jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/texera_db?currentSchema=texera_db,public
+              value: jdbc:postgresql://{{ include "texera.postgresql.fullname" . }}:5432/texera_db?currentSchema=texera_db,public
             - name: STORAGE_JDBC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgresql
+                  name: {{ include "texera.postgresql.fullname" . }}
                   key: postgres-password
             # LakeFS Access (should be removed in production environment)
             - name: STORAGE_LAKEFS_ENDPOINT
diff --git a/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-deployment.yaml b/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-deployment.yaml
index 2061e9e53ef..6bc6c0ff6d8 100644
--- a/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-deployment.yaml
+++ b/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-deployment.yaml
@@ -57,11 +57,11 @@ spec:
                   key: secret_key
             # TexeraDB Access
             - name: STORAGE_JDBC_URL
-              value: jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/texera_db?currentSchema=texera_db,public
+              value: jdbc:postgresql://{{ include "texera.postgresql.fullname" . }}:5432/texera_db?currentSchema=texera_db,public
             - name: STORAGE_JDBC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgresql
+                  name: {{ include "texera.postgresql.fullname" . }}
                   key: postgres-password
             {{- range .Values.texeraEnvVars }}
             - name: {{ .name }}
diff --git a/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-deployment.yaml b/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-deployment.yaml
index ea61b242d1f..57f46538fdc 100644
--- a/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-deployment.yaml
+++ b/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-deployment.yaml
@@ -68,11 +68,11 @@ spec:
               value: {{ .Values.texera.imageRegistry }}/{{ .Values.workflowComputingUnitPool.imageName }}:{{ .Values.texera.imageTag }}
             # TexeraDB Access
             - name: STORAGE_JDBC_URL
-              value: jdbc:postgresql://{{ .Release.Name }}-postgresql:5432/texera_db?currentSchema=texera_db,public
+              value: jdbc:postgresql://{{ include "texera.postgresql.fullname" . }}:5432/texera_db?currentSchema=texera_db,public
             - name: STORAGE_JDBC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgresql
+                  name: {{ include "texera.postgresql.fullname" . }}
                   key: postgres-password
             # FileService Access
             - name: FILE_SERVICE_GET_DATASET_PRESIGNED_URL_ENDPOINT
diff --git a/bin/k8s/values-aws.yaml b/bin/k8s/values-aws.yaml
index 8d1b0a36982..fb4b81631ae 100644
--- a/bin/k8s/values-aws.yaml
+++ b/bin/k8s/values-aws.yaml
@@ -40,7 +40,7 @@ storage:
     # Recommended: reference a pre-created Secret with keys access-key-id /
     # secret-access-key (e.g. one synced from AWS Secrets Manager), and leave
     # accessKeyId / secretAccessKey empty. Otherwise the chart creates a Secret
-    # named "<release>-s3-credentials" from the inline values below.
+    # named "texera-s3-credentials" from the inline values below.
     existingSecret: ""
     accessKeyId: "REPLACE_WITH_ACCESS_KEY_ID"
     secretAccessKey: "REPLACE_WITH_SECRET_ACCESS_KEY"
@@ -49,11 +49,10 @@ storage:
 # the endpoint from the region) with credentials injected via the same Secret
 # the chart/app uses.
 #
-# NOTE: the secretKeyRef "name" below is "texera-s3-credentials", which assumes
-# the Helm release is named "texera" (the chart generates the credentials Secret
-# as "<release>-s3-credentials"). If you install with a different release name,
-# or set storage.s3.existingSecret above, update both "name:" fields below to
-# match that Secret.
+# NOTE: the secretKeyRef "name" below is the chart-generated Secret
+# "texera-s3-credentials" (a fixed name, independent of the Helm release name).
+# If you set storage.s3.existingSecret above, update both "name:" fields below
+# to match that Secret instead.
 lakefs:
   lakefsConfig: |
     database:
diff --git a/bin/k8s/values.yaml b/bin/k8s/values.yaml
index 9c37d3b4080..c192d916267 100644
--- a/bin/k8s/values.yaml
+++ b/bin/k8s/values.yaml
@@ -39,6 +39,12 @@ persistence:
 
 # Part 1: the configuration of Postgres, Minio and LakeFS
 postgresql:
+  # Pinned so the name does not depend on the Helm release name. The lakefs and
+  # lakekeeper sub-charts address this database from their own values blocks
+  # below, and Helm does not template values files -- so the name they point at
+  # has to be a constant. Chart templates resolve it via the
+  # "texera.postgresql.fullname" helper, so both sides always agree.
+  fullnameOverride: texera-postgresql
   image:
     repository: groonga/pgroonga
     tag: latest
@@ -82,6 +88,9 @@ minio:
   # external S3 store instead (configure storage.s3 above and the lakefs/
   # lakekeeperInit blocks below). See values-aws.yaml for a complete example.
   enabled: true
+  # Pinned for the same reason as postgresql.fullnameOverride above: the lakefs
+  # blockstore endpoint is set from the lakefs sub-chart's own values.
+  fullnameOverride: texera-minio
   mode: standalone
   image:
     repository: bitnamilegacy/minio