diff --git a/charts/conduit/Chart.yaml b/charts/conduit/Chart.yaml
index e5aee45..60df582 100644
--- a/charts/conduit/Chart.yaml
+++ b/charts/conduit/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.9
+version: 0.2.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/conduit/README.md b/charts/conduit/README.md
index 3ed7e87..fe78fac 100644
--- a/charts/conduit/README.md
+++ b/charts/conduit/README.md
@@ -1,6 +1,6 @@
 # Conduit
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.14.7](https://img.shields.io/badge/AppVersion-0.14.7-informational?style=flat-square)
+![Version: 0.2.10](https://img.shields.io/badge/Version-0.2.10-informational?style=flat-square)  ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![AppVersion: v0.16.17](https://img.shields.io/badge/AppVersion-v0.16.17-informational?style=flat-square)
 
 Conduit is a NodeJS-based Self-Hosted backend, that aims to cut down development times by providing ready-made modules that offer common functionality out of the box, and allowing maximum flexibility to add custom functionality.
 
@@ -81,10 +81,6 @@ a) Default Mongo image. Set `.Values.mongodb.enabled` to `true`, for this option
 
 b) External Database, Mongo or Postgres. Set the `.Values.externalDatabase.url` along with its type, for this option.
 
-### MongoDB replicas (Atlas)
-
-For deployments with replica sets, connector URI options (for example `readPreference` query parameters on `externalDatabase.url`) define driver-level defaults. After install, operators can tune routing via **Admin UI → Database → Settings** (`readPreference`, `writeConcern`, `readConcern`) or the admin config API; these merge with optional **per-schema** overrides on declared schemas and **per-query** overrides from modules. Defaults match the MongoDB driver (`primary` / `w: 1` / `local`) so upgrades stay non-breaking until you opt in to secondary reads.
-
 3. Loki (optional)
 
 a) Loki chart dependency. Set `.Values.loki.setup` to `true`, for this option.
@@ -97,6 +93,16 @@ a) Prometheus chart dependency. Set `.Values.prometheus.setup` to `true`, for th
 
 b) External Prometheus. Set `.Values.externalPrometheus.url` to `true`, for this option.
 
+## Embeddings (disabled by default)
+
+`install.embeddings.enabled` deploys the embeddings Kubernetes workload only. It is not the embeddings module-config `enabled` flag that starts generation or search workers.
+
+Set `install.embeddings.enabled=true` only after `conduitplatform/embeddings` exists at `install.embeddings.image.tag` (defaults to `global.image.tag`). Chart `appVersion` does not mean that image exists.
+
+Requires `global.secret.grpc_enable=true` (`GRPC_KEY`). The chart rejects `install.embeddings.enabled=true` when gRPC secrets are disabled.
+
+Deploy the workload with module-config workers still disabled, then enable workers after the pod is running. `install.embeddings.enabled: false` removes the Deployment/Service; vector fields, indexes, embedding configs, and Redis queue state are retained.
+
 ## Custom Resource Definition
 
 By default this chart will install the Custom Resource Definition for Prometheus Service Monitors, located in crds/crd-servicemonitor.yaml.
@@ -143,7 +149,7 @@ Due to the use of the lookup function the random secret values will not be re-ge
 ## Install object
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| install | object | `{"authentication":{"enabled":true,"image":{"name":"authentication"},"metrics":{"enabled":true}},"chat":{"enabled":true,"image":{"name":"chat"},"metrics":{"enabled":true}},"email":{"enabled":true,"image":{"name":"email"},"metrics":{"enabled":true}},"forms":{"enabled":true,"image":{"name":"forms"},"metrics":{"enabled":true}},"notification":{"enabled":true,"image":{"name":"push-notifications"},"metrics":{"enabled":true}},"sms":{"enabled":true,"image":{"name":"sms"},"metrics":{"enabled":true}},"storage":{"enabled":true,"image":{"name":"storage"},"metrics":{"enabled":true}}}` | Choosing which microservices you want deployed (except for Admin-UI, Core, Database and Router) |
+| install | object | See `values.yaml` | Choosing which microservices you want deployed (except for Admin-UI, Core, Database and Router). `install.embeddings` is disabled by default. |
 
 ## Module settings to apply to all services of the install object
 | Key | Type | Default | Description |
diff --git a/charts/conduit/README.md.gotmpl b/charts/conduit/README.md.gotmpl
index f4c7ffd..168dd3d 100644
--- a/charts/conduit/README.md.gotmpl
+++ b/charts/conduit/README.md.gotmpl
@@ -1,6 +1,6 @@
-# Conduit 
+# Conduit
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.14.7](https://img.shields.io/badge/AppVersion-0.14.7-informational?style=flat-square)
+{{ template "chart.versionBadge" . }} {{ template "chart.typeBadge" . }} {{ template "chart.appVersionBadge" . }}
 
 Conduit is a NodeJS-based Self-Hosted backend, that aims to cut down development times by providing ready-made modules that offer common functionality out of the box, and allowing maximum flexibility to add custom functionality.
 
@@ -93,6 +93,16 @@ a) Prometheus chart dependency. Set `.Values.prometheus.setup` to `true`, for th
 
 b) External Prometheus. Set `.Values.externalPrometheus.url` to `true`, for this option.
 
+## Embeddings (disabled by default)
+
+`install.embeddings.enabled` deploys the embeddings Kubernetes workload only. It is not the embeddings module-config `enabled` flag that starts generation or search workers.
+
+Set `install.embeddings.enabled=true` only after `conduitplatform/embeddings` exists at `install.embeddings.image.tag` (defaults to `global.image.tag`). Chart `appVersion` does not mean that image exists.
+
+Requires `global.secret.grpc_enable=true` (`GRPC_KEY`). The chart rejects `install.embeddings.enabled=true` when gRPC secrets are disabled.
+
+Deploy the workload with module-config workers still disabled, then enable workers after the pod is running. `install.embeddings.enabled: false` removes the Deployment/Service; vector fields, indexes, embedding configs, and Redis queue state are retained.
+
 ## Custom Resource Definition
 
 By default this chart will install the Custom Resource Definition for Prometheus Service Monitors, located in crds/crd-servicemonitor.yaml.
@@ -139,7 +149,7 @@ Due to the use of the lookup function the random secret values will not be re-ge
 ## Install object
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| install | object | `{"authentication":{"enabled":true,"image":{"name":"authentication"},"metrics":{"enabled":true}},"chat":{"enabled":true,"image":{"name":"chat"},"metrics":{"enabled":true}},"email":{"enabled":true,"image":{"name":"email"},"metrics":{"enabled":true}},"forms":{"enabled":true,"image":{"name":"forms"},"metrics":{"enabled":true}},"notification":{"enabled":true,"image":{"name":"push-notifications"},"metrics":{"enabled":true}},"sms":{"enabled":true,"image":{"name":"sms"},"metrics":{"enabled":true}},"storage":{"enabled":true,"image":{"name":"storage"},"metrics":{"enabled":true}}}` | Choosing which microservices you want deployed (except for Admin-UI, Core, Database and Router) |
+| install | object | See `values.yaml` | Choosing which microservices you want deployed (except for Admin-UI, Core, Database and Router). `install.embeddings` is disabled by default. |
 
 ## Module settings to apply to all services of the install object
 | Key | Type | Default | Description |
diff --git a/charts/conduit/templates/NOTES.txt b/charts/conduit/templates/NOTES.txt
index 5f92ba4..e4fb7be 100644
--- a/charts/conduit/templates/NOTES.txt
+++ b/charts/conduit/templates/NOTES.txt
@@ -27,4 +27,12 @@ b) External Loki. Set .Values.externalLoki.url to true, for this option.
 4. Prometheus Metrics (optional)
 
 a) Prometheus chart dependency. Set .Values.prometheus.setup to true, for this option.
-b) External Prometheus. Set .Values.externalPrometheus.url to true, for this option.
\ No newline at end of file
+b) External Prometheus. Set .Values.externalPrometheus.url to true, for this option.
+
+5. Embeddings (optional, disabled by default)
+
+install.embeddings.enabled deploys the Kubernetes workload only; it is not the embeddings module-config enabled flag that starts generation/search workers.
+
+Set install.embeddings.enabled=true only after conduitplatform/embeddings exists at the chosen image tag (install.embeddings.image.tag, defaulting to global.image.tag). Chart appVersion does not mean that image exists.
+
+Requires global.secret.grpc_enable=true (GRPC_KEY). Roll out with module-config workers still disabled. Rollback with install.embeddings.enabled=false; vector fields, indexes, embedding configs, and Redis state are retained.
\ No newline at end of file
diff --git a/charts/conduit/templates/_helpers.tpl b/charts/conduit/templates/_helpers.tpl
index 8349990..88e4545 100644
--- a/charts/conduit/templates/_helpers.tpl
+++ b/charts/conduit/templates/_helpers.tpl
@@ -233,11 +233,23 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
-Validate global image tag version (must be 'latest' or >= v0.16.18) */}}
+Validate global image tag version (must be 'latest', 'dev', 'next', or >= Chart.AppVersion)
+*/}}
 {{- define "conduit-helm.validateImageTag" -}}
 {{- $tag := default "" .Values.global.image.tag -}}
-{{- if and $tag (not (eq $tag "latest")) (not (eq $tag "dev")) (not (eq $tag "next")) (semverCompare "<v0.16.18" $tag) -}}
-{{- fail (printf "global.image.tag '%s' is not supported by this chart; use 'latest', 'dev', 'next' or v0.16.18+" $tag) -}}
+{{- $min := .Chart.AppVersion -}}
+{{- if and $tag (not (eq $tag "latest")) (not (eq $tag "dev")) (not (eq $tag "next")) (semverCompare (printf "<%s" $min) $tag) -}}
+{{- fail (printf "global.image.tag '%s' is not supported by this chart; use 'latest', 'dev', 'next' or %s+" $tag $min) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Reject embeddings workload without GRPC_KEY
+*/}}
+{{- define "conduit-helm.validateEmbeddings" -}}
+{{- $embeddings := default dict .Values.install.embeddings -}}
+{{- if and $embeddings.enabled (not .Values.global.secret.grpc_enable) -}}
+{{- fail "install.embeddings.enabled=true requires global.secret.grpc_enable=true so GRPC_KEY is mounted" -}}
 {{- end -}}
 {{- end -}}
 
diff --git a/charts/conduit/templates/services/deployment.yaml b/charts/conduit/templates/services/deployment.yaml
index 5672c12..17726fe 100644
--- a/charts/conduit/templates/services/deployment.yaml
+++ b/charts/conduit/templates/services/deployment.yaml
@@ -1,6 +1,8 @@
 {{ $moduleSettings := index .Values "module-settings" }}
 {{- range $module, $spec := .Values.install -}}
 {{- $specService := $spec.service -}}
+{{- $specMetrics := $spec.metrics -}}
+{{- $specMetricsService := $spec.metrics.service -}}
 {{- if $spec.enabled }}
 ---
 apiVersion: apps/v1
@@ -73,14 +75,15 @@ spec:
           securityContext:
             {{- toYaml $.Values.securityContext | nindent 12 }}
           resources:
-            {{- if $moduleSettings.resources }}
-              {{- toYaml $moduleSettings.resources | nindent 12 }}
-            {{- end }}
-            {{- if $spec.resources }}
-              {{- toYaml $spec.resources | nindent 12 }}
-            {{- end }}
+            {{- $moduleResources := default (dict) $moduleSettings.resources }}
+            {{- $specResources := default (dict) $spec.resources }}
+            {{- toYaml (mergeOverwrite (deepCopy $moduleResources) $specResources) | nindent 12 }}
           ports:
             - containerPort: {{ coalesce $spec.containerPort $moduleSettings.containerPort $.Values.global.config.grpc_port }}
+            {{- if $specMetrics.enabled }}
+            - name: metrics
+              containerPort: {{ default $moduleSettings.metrics.service.targetPort $specMetricsService.targetPort }}
+            {{- end }}
           {{- $specReadiness := default (dict) $spec.readinessProbe }}
           {{- $moduleReadiness := default (dict) $moduleSettings.readinessProbe }}
           {{- $specLiveness := default (dict) $spec.livenessProbe }}
@@ -123,7 +126,11 @@ spec:
                   key: GRPC_KEY
             {{- end }}
             - name: GRPC_PORT
-              value: {{ coalesce $specService.containerPort $moduleSettings.containerPort $.Values.global.config.grpc_port | quote }}
+              value: {{ coalesce $spec.containerPort $moduleSettings.containerPort $.Values.global.config.grpc_port | quote }}
+            {{- if $specMetrics.enabled }}
+            - name: METRICS_PORT
+              value: {{ default $moduleSettings.metrics.service.targetPort $specMetricsService.targetPort | quote }}
+            {{- end }}
             {{- if $moduleSettings.env }}
               {{- toYaml $moduleSettings.env | nindent 12 }}
             {{- end }}
diff --git a/charts/conduit/templates/services/service.headless.yaml b/charts/conduit/templates/services/service.headless.yaml
index 71a0e0c..74d4f49 100644
--- a/charts/conduit/templates/services/service.headless.yaml
+++ b/charts/conduit/templates/services/service.headless.yaml
@@ -37,13 +37,13 @@ spec:
     app: {{ template "conduit-helm.fullname" $ }}-{{ $module }}
   ports:
     - protocol: TCP
-      port: {{ coalesce $specService.grpc_port $moduleSettings.containerPort $.Values.global.config.grpc_port }}
+      port: {{ coalesce $specService.grpc_port $spec.containerPort $moduleSettings.containerPort $.Values.global.config.grpc_port }}
       name: tcp
-      targetPort: {{ coalesce $specService.grpc_port $moduleSettings.containerPort $.Values.global.config.grpc_port }}
+      targetPort: {{ coalesce $specService.grpc_port $spec.containerPort $moduleSettings.containerPort $.Values.global.config.grpc_port }}
 {{- if $spec.metrics.enabled }}
-    - port: {{ $.Values.global.config.metrics_port }}
+    - port: {{ default $moduleSettings.metrics.service.port $specMetricsService.port }}
       name: {{ default $moduleSettings.metrics.service.name $specMetricsService.name }}
-      targetPort: {{ $.Values.global.config.metrics_port }}
+      targetPort: {{ default $moduleSettings.metrics.service.targetPort $specMetricsService.targetPort }}
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/conduit/templates/services/service.yaml b/charts/conduit/templates/services/service.yaml
index 36558b4..83d46ac 100644
--- a/charts/conduit/templates/services/service.yaml
+++ b/charts/conduit/templates/services/service.yaml
@@ -47,11 +47,11 @@ spec:
     - protocol: TCP
       port: {{ default $moduleSettings.service.tcp_port $specService.tcp_port }}
       name: tcp
-      targetPort: {{ coalesce $specService.grpc_port $moduleSettings.containerPort $.Values.global.config.grpc_port }}
+      targetPort: {{ coalesce $specService.grpc_port $spec.containerPort $moduleSettings.containerPort $.Values.global.config.grpc_port }}
 {{- if $spec.metrics.enabled }}
     - port: {{ default $moduleSettings.metrics.service.port $specMetricsService.port }}
       name: {{ default $moduleSettings.metrics.service.name $specMetricsService.name }}
-      targetPort: {{ $.Values.global.config.metrics_port }}
+      targetPort: {{ default $moduleSettings.metrics.service.targetPort $specMetricsService.targetPort }}
 {{- end }}
   type: ClusterIP
 {{- end }}
diff --git a/charts/conduit/templates/validate-image-tag.yaml b/charts/conduit/templates/validate-image-tag.yaml
index 98289da..f6a62e5 100644
--- a/charts/conduit/templates/validate-image-tag.yaml
+++ b/charts/conduit/templates/validate-image-tag.yaml
@@ -1 +1,2 @@
 {{- include "conduit-helm.validateImageTag" . -}}
+{{- include "conduit-helm.validateEmbeddings" . -}}
diff --git a/charts/conduit/values.dev.yaml b/charts/conduit/values.dev.yaml
index 643a3c6..1ed321e 100644
--- a/charts/conduit/values.dev.yaml
+++ b/charts/conduit/values.dev.yaml
@@ -27,6 +27,8 @@ install:
     enabled: false
   storage:
     enabled: false
+  embeddings:
+    enabled: false
 module-settings:
   # -- Resource limits and requests
   resources:
diff --git a/charts/conduit/values.yaml b/charts/conduit/values.yaml
index 6766967..07f664e 100644
--- a/charts/conduit/values.yaml
+++ b/charts/conduit/values.yaml
@@ -140,6 +140,39 @@ install:
       name: storage
     metrics:
       enabled: true
+  # -- Embeddings Kubernetes workload, not module-config workers. Disabled by default. Requires global.secret.grpc_enable=true.
+  embeddings:
+    enabled: false
+    image:
+      name: embeddings
+    containerPort: 55165
+    resources:
+      requests:
+        memory: "256Mi"
+        cpu: "100m"
+      limits:
+        memory: "1Gi"
+        cpu: "1000m"
+    readinessProbe:
+      initialDelaySeconds: 15
+      periodSeconds: 5
+      timeoutSeconds: 1
+      successThreshold: 1
+      failureThreshold: 6
+    livenessProbe:
+      initialDelaySeconds: 30
+      periodSeconds: 10
+      timeoutSeconds: 1
+      successThreshold: 1
+      failureThreshold: 5
+    service:
+      tcp_port: 55165
+      grpc_port: 55165
+    metrics:
+      enabled: true
+      service:
+        port: 9192
+        targetPort: 9192
 
 # -- Default module settings for the microservices (except Admin-UI, Core, Database, Router)
 module-settings: