diff --git a/helm/tools/grafana-mcp/templates/_helpers.tpl b/helm/tools/grafana-mcp/templates/_helpers.tpl
index af4da7f48..686873d3d 100644
--- a/helm/tools/grafana-mcp/templates/_helpers.tpl
+++ b/helm/tools/grafana-mcp/templates/_helpers.tpl
@@ -75,4 +75,19 @@ Join registry/repository/name/tag for grafana-mcp image, skipping empty segments
 {{- $img := .Values.image -}}
 {{- $parts := compact (list $img.registry $img.repository $img.name) -}}
 {{- printf "%s:%s" (join "/" $parts) $img.tag -}}
+{{- end -}}
+
+{{- define "grafana-mcp.allowedHosts" -}}
+{{- if .Values.allowedHosts -}}
+{{- join "," .Values.allowedHosts -}}
+{{- else -}}
+{{- $fullname := include "grafana-mcp.fullname" . -}}
+{{- $ns := .Release.Namespace -}}
+{{- $port := .Values.service.port | int -}}
+{{- join "," (list (printf "%s:%d" $fullname $port)
+                   (printf "%s.%s:%d" $fullname $ns $port)
+                   (printf "%s.%s.svc:%d" $fullname $ns $port)
+                   (printf "%s.%s.svc.cluster.local:%d" $fullname $ns $port)
+                   (printf "localhost:%d" $port)) -}}
+{{- end -}}
 {{- end -}}
\ No newline at end of file
diff --git a/helm/tools/grafana-mcp/templates/deployment.yaml b/helm/tools/grafana-mcp/templates/deployment.yaml
index bf3be83f3..03497ebe6 100644
--- a/helm/tools/grafana-mcp/templates/deployment.yaml
+++ b/helm/tools/grafana-mcp/templates/deployment.yaml
@@ -40,6 +40,7 @@ spec:
           args:
             - --transport
             - streamable-http
+            - --allowed-hosts={{ include "grafana-mcp.allowedHosts" . }}
             {{- with .Values.args }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
diff --git a/helm/tools/grafana-mcp/tests/deployment_test.yaml b/helm/tools/grafana-mcp/tests/deployment_test.yaml
index d1ed1c4ad..be7f0b4f3 100644
--- a/helm/tools/grafana-mcp/tests/deployment_test.yaml
+++ b/helm/tools/grafana-mcp/tests/deployment_test.yaml
@@ -119,4 +119,32 @@ tests:
           value: grafana:latest
       - notMatchRegex:
           path: spec.template.spec.containers[0].image
-          pattern: "^/"          # no leading slash
\ No newline at end of file
+          pattern: "^/"          # no leading slash
+
+  - it: should configure allowed-hosts with default DNS variants
+    template: deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-hosts=RELEASE-NAME-grafana-mcp:8000,RELEASE-NAME-grafana-mcp.NAMESPACE:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc:8000,RELEASE-NAME-grafana-mcp.NAMESPACE.svc.cluster.local:8000,localhost:8000
+
+  - it: should use custom allowedHosts when configured
+    template: deployment.yaml
+    set:
+      allowedHosts:
+        - "custom-host:8000"
+        - "*.kagent:8000"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-hosts=custom-host:8000,*.kagent:8000
+
+  - it: should allow wildcard allowedHosts
+    template: deployment.yaml
+    set:
+      allowedHosts:
+        - "*"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --allowed-hosts=*
diff --git a/helm/tools/grafana-mcp/values.yaml b/helm/tools/grafana-mcp/values.yaml
index 01f0f1f50..07cbac57a 100644
--- a/helm/tools/grafana-mcp/values.yaml
+++ b/helm/tools/grafana-mcp/values.yaml
@@ -50,6 +50,13 @@ resources:
     cpu: 500m
     memory: 512Mi
 
+# allowedHosts configures the --allowed-hosts argument for mcp-grafana's Host header
+# validation (required for streamable-http transport). When empty, defaults to the
+# standard Kubernetes Service DNS variants (<name>.<namespace>, <name>.<namespace>.svc,
+# <name>.<namespace>.svc.cluster.local, localhost). Override with a list of hosts or
+# set to ["*"] to allow all hosts.
+allowedHosts: []
+
 # Additional Arguments for the mcp server
 args: []