diff --git a/charts/model-engine/Chart.yaml b/charts/model-engine/Chart.yaml
index 26a32221..ed2f7a2a 100644
--- a/charts/model-engine/Chart.yaml
+++ b/charts/model-engine/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.9
+version: 0.2.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/charts/model-engine/templates/service_template_config_map.yaml b/charts/model-engine/templates/service_template_config_map.yaml
index 57432a06..b0fbab75 100644
--- a/charts/model-engine/templates/service_template_config_map.yaml
+++ b/charts/model-engine/templates/service_template_config_map.yaml
@@ -360,6 +360,9 @@ data:
                   memory: ${MEMORY}
                   ${STORAGE_DICT}
               volumeMounts:
+                {{- with $.Values.extraPodVolumeMounts }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
                 {{- if $require_aws_config }}
                 - name: config-volume
                   mountPath: /opt/.aws/config
@@ -385,6 +388,9 @@ data:
           securityContext:
             fsGroup: 65534
           volumes:
+            {{- with $.Values.extraPodVolumes }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
             {{- if $require_aws_config }}
             - name: config-volume
               configMap:
@@ -774,6 +780,9 @@ data:
                     memory: ${MEMORY}
                     ${STORAGE_DICT}
                 volumeMounts:
+                  {{- with $.Values.extraPodVolumeMounts }}
+                  {{- toYaml . | nindent 18 }}
+                  {{- end }}
                   {{- if $require_aws_config }}
                   - name: config-volume
                     mountPath: /opt/.aws/config
@@ -795,6 +804,9 @@ data:
                   - containerPort: ${USER_CONTAINER_PORT}
                     name: http
             volumes:
+              {{- with $.Values.extraPodVolumes }}
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
               {{- if $require_aws_config }}
               - name: config-volume
                 configMap:
@@ -871,6 +883,10 @@ data:
                 imagePullPolicy: IfNotPresent
                 command: ${WORKER_COMMAND}
                 env: ${WORKER_ENV}
+                {{- with $.Values.extraPodEnvFrom }}
+                envFrom:
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
                 resources:
                   requests:
                     {{- if eq $device "gpu" }}
@@ -887,6 +903,9 @@ data:
                     memory: ${MEMORY}
                     ${STORAGE_DICT}
                 volumeMounts:
+                  {{- with $.Values.extraPodVolumeMounts }}
+                  {{- toYaml . | nindent 18 }}
+                  {{- end }}
                   {{- if $require_aws_config }}
                   - name: config-volume
                     mountPath: /opt/.aws/config
@@ -908,6 +927,9 @@ data:
                   - containerPort: ${USER_CONTAINER_PORT}
                     name: http
             volumes:
+              {{- with $.Values.extraPodVolumes }}
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
               {{- if $require_aws_config }}
               - name: config-volume
                 configMap:
@@ -1093,6 +1115,9 @@ data:
           {{- end }}
           serviceAccountName: {{ $launch_name }}
           volumes:
+            {{- with $.Values.extraPodVolumes }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
             {{- if $require_aws_config }}
             - name: config-volume
               configMap:
@@ -1128,6 +1153,10 @@ data:
                 {{- end }}
                 {{- end }}
               imagePullPolicy: IfNotPresent
+              {{- with $.Values.extraPodEnvFrom }}
+              envFrom:
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
               command:
                 - dumb-init
                 - --
@@ -1159,6 +1188,9 @@ data:
                   memory: 32Gi
                   ephemeral-storage: 30Gi
               volumeMounts:
+                {{- with $.Values.extraPodVolumeMounts }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
                 {{- if $require_aws_config }}
                 - name: config-volume
                   mountPath: /opt/.aws/config
@@ -1221,6 +1253,9 @@ data:
           serviceAccountName: {{ $launch_name }}
           {{- end }}
           volumes:
+            {{- with $.Values.extraPodVolumes }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
             {{- if $require_aws_config }}
             - name: config-volume
               configMap:
@@ -1273,6 +1308,9 @@ data:
                   memory: ${MEMORY}
                   ${STORAGE_DICT}
               volumeMounts:
+                {{- with $.Values.extraPodVolumeMounts }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
                 {{- if $require_aws_config }}
                 - name: config-volume
                   mountPath: /opt/.aws/config
@@ -1292,6 +1330,10 @@ data:
               env:
                 - name: AWS_CONFIG_FILE
                   value: "/opt/.aws/config"
+              {{- with $.Values.extraPodEnvFrom }}
+              envFrom:
+              {{- toYaml . | nindent 14 }}
+              {{- end }}
               command:
                 - python
                 - -m
@@ -1311,6 +1353,9 @@ data:
                   cpu: 1
                   memory: 1Gi
               volumeMounts:
+                {{- with $.Values.extraPodVolumeMounts }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
                 {{- if $require_aws_config }}
                 - name: config-volume
                   mountPath: /opt/.aws/config
diff --git a/charts/model-engine/values.yaml b/charts/model-engine/values.yaml
index 664a9766..67060e07 100644
--- a/charts/model-engine/values.yaml
+++ b/charts/model-engine/values.yaml
@@ -111,6 +111,15 @@ extraEnvVars: []              # Extra env vars for all main containers (gateway,
 extraVolumes: []              # Extra volumes for all deployments
 extraVolumeMounts: []         # Extra volume mounts for main containers
 extraPodEnvFrom: []           # Extra envFrom for inference pods (e.g., MinIO credentials)
+# Extra volumes for every workload the service template renders that reads object
+# storage: the endpoint Deployment, both halves of a LeaderWorkerSet, the batch jobs and
+# the input-downloader initContainer. Distinct from extraVolumes above, which only
+# reaches the control-plane deployments. These pod specs have a fixed volume list, so a
+# site that has to hand them a file (a private CA for an S3 endpoint, say) has no other
+# way in: extraPodEnvFrom carries env only, and both existing mounts use subPath/items
+# and project a single named key.
+extraPodVolumes: []
+extraPodVolumeMounts: []
 
 # PVC-backed model cache for endpoint pods. When enabled, model downloads are cached on
 # one endpoint-scoped PVC instead of the pod's ephemeral storage. The default access