diff --git a/charts/helm/checkmate/INSTALLATION.md b/charts/helm/checkmate/INSTALLATION.md
index c0528b66b..7177da86a 100644
--- a/charts/helm/checkmate/INSTALLATION.md
+++ b/charts/helm/checkmate/INSTALLATION.md
@@ -42,6 +42,51 @@ kubectl get svc
 
 Once all pods are `Running` and `Ready`, you can access Checkmate via the configured ingress hosts.
 
+## Upgrading from a previous release
+
+This release renames the `server.*` value block to `api.*` and drops the (unused) bundled Redis.
+Read this before running `helm upgrade` on an existing install.
+
+### `server.*` → `api.*` (values rename)
+
+The value block formerly named `server` is now `api` (`server.image` → `api.image`,
+`server.ingress.host` → `api.ingress.host`, `server.protocol` → `api.protocol`, `server.resources`,
+`server.affinity`, `server.tolerations`, `server.ingress.*`, etc.).
+
+**Your existing `server.*` overrides keep working** — the chart merges any legacy `server.*` values on
+top of the `api.*` defaults (legacy wins where set), so an unchanged values file upgrades cleanly. The
+shim is transitional; migrate your overrides to `api.*` at your convenience and drop the `server:`
+block. If you set **both** `server.*` and `api.*` for the same field, the legacy `server.*` value wins —
+don't mix them.
+
+### Resource renames cause a replace, not a rename
+
+The Kubernetes objects are renamed alongside the values:
+
+| Old object | New object |
+| --- | --- |
+| Deployment/Service `checkmate-server` | `checkmate-api` |
+| Ingress `checkmate-server-ingress` | `checkmate-api-ingress` |
+| ConfigMap `checkmate-server-nginx-cm` | `checkmate-client-nginx-cm` |
+
+Helm deletes the old objects and creates the new ones on upgrade. Expect a brief API restart and a
+**new ClusterIP** for the API Service — update anything outside the chart that referenced the
+`checkmate-server` Service by name. MongoDB data (its PVC) is untouched.
+
+### Redis removed
+
+The bundled Redis StatefulSet/Service and the `redis.*` / `persistence.redis.*` values are gone — the
+scheduler runs in-process and never used them. Default installs (`redis.enabled: false`) are
+unaffected. If you had explicitly set `redis.enabled: true`, **the Redis StatefulSet and its PVC are
+deleted on upgrade** — back up anything you stored there first. Leftover `redis:` / `persistence.redis:`
+keys in your values file are harmless (ignored).
+
+### New secret defaults
+
+`NODE_ENV: production`, `LOG_LEVEL: info`, and `TOKEN_TTL: 99d` are now part of the default `secrets`
+block and merge into your install unless you override them. Set them explicitly if you relied on
+different values (e.g. a non-production `NODE_ENV`).
+
 ## Scaling: the worker tier & autoscaling
 
 By default the chart runs a single all-in-one API pod that both schedules **and** processes monitoring
diff --git a/charts/helm/checkmate/templates/_helpers.tpl b/charts/helm/checkmate/templates/_helpers.tpl
new file mode 100644
index 000000000..a65766ab8
--- /dev/null
+++ b/charts/helm/checkmate/templates/_helpers.tpl
@@ -0,0 +1,16 @@
+{{- /*
+Back-compat shim: the `server.*` value block was renamed to `api.*`. Existing installs that
+still pass a legacy `server:` block keep working — this returns the effective API values with any
+legacy `server.*` overrides merged on top of the `api.*` defaults (legacy wins where set).
+
+New installs have no `server:` key, so this is a no-op deepCopy of `.Values.api`. Consume it as:
+  {{- $api := include "checkmate.api" . | fromYaml -}}
+then reference `$api.*` instead of `.Values.api.*`.
+*/}}
+{{- define "checkmate.api" -}}
+{{- $api := deepCopy .Values.api -}}
+{{- with .Values.server -}}
+{{- $api = mergeOverwrite $api (deepCopy .) -}}
+{{- end -}}
+{{- $api | toYaml -}}
+{{- end -}}
diff --git a/charts/helm/checkmate/templates/api/deployment.yaml b/charts/helm/checkmate/templates/api/deployment.yaml
index 8433ecd58..542c6d0af 100644
--- a/charts/helm/checkmate/templates/api/deployment.yaml
+++ b/charts/helm/checkmate/templates/api/deployment.yaml
@@ -1,3 +1,4 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -12,21 +13,21 @@ spec:
       labels:
         app: checkmate-api
     spec:
-    {{- with .Values.api.affinity }}
+    {{- with $api.affinity }}
       affinity:
         {{- tpl ( . | toYaml) $ | nindent 8 }}
     {{- end }}
-    {{- with .Values.api.tolerations }}
+    {{- with $api.tolerations }}
       tolerations:
         {{- tpl ( . | toYaml) $ | nindent 8 }}
     {{- end }}
       containers:
         - name: api
-          image: {{ .Values.api.image }}
-          imagePullPolicy: {{ .Values.api.imagePullPolicy }}
+          image: {{ $api.image }}
+          imagePullPolicy: {{ $api.imagePullPolicy }}
           ports:
             - name: http
-              containerPort: {{ .Values.api.port }}
+              containerPort: {{ $api.port }}
           envFrom:
             - secretRef:
                 name: checkmate-secrets
@@ -37,19 +38,19 @@ spec:
             httpGet:
               path: /api/v1/health
               port: http
-            initialDelaySeconds: {{ .Values.api.probes.liveness.initialDelaySeconds }}
-            periodSeconds: {{ .Values.api.probes.liveness.periodSeconds }}
-            timeoutSeconds: {{ .Values.api.probes.liveness.timeoutSeconds }}
-            failureThreshold: {{ .Values.api.probes.liveness.failureThreshold }}
+            initialDelaySeconds: {{ $api.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ $api.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ $api.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ $api.probes.liveness.failureThreshold }}
           readinessProbe:
             httpGet:
               path: /api/v1/health
               port: http
-            initialDelaySeconds: {{ .Values.api.probes.readiness.initialDelaySeconds }}
-            periodSeconds: {{ .Values.api.probes.readiness.periodSeconds }}
-            timeoutSeconds: {{ .Values.api.probes.readiness.timeoutSeconds }}
-            failureThreshold: {{ .Values.api.probes.readiness.failureThreshold }}
-          {{- with .Values.api.resources }}
+            initialDelaySeconds: {{ $api.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ $api.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ $api.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ $api.probes.readiness.failureThreshold }}
+          {{- with $api.resources }}
           resources:
               {{- tpl ( . | toYaml) $ | nindent 12 }}
           {{- end }}
diff --git a/charts/helm/checkmate/templates/api/ingress.yaml b/charts/helm/checkmate/templates/api/ingress.yaml
index f6b9db114..ae60889f2 100644
--- a/charts/helm/checkmate/templates/api/ingress.yaml
+++ b/charts/helm/checkmate/templates/api/ingress.yaml
@@ -1,11 +1,12 @@
-{{- if .Values.api.ingress.enabled }}
+{{- $api := include "checkmate.api" . | fromYaml -}}
+{{- if $api.ingress.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: checkmate-api-ingress
-  {{- if .Values.api.ingress.annotations }}
+  {{- if $api.ingress.annotations }}
   annotations:
-    {{- range $key, $value := .Values.api.ingress.annotations }}
+    {{- range $key, $value := $api.ingress.annotations }}
     {{ $key }}: {{ $value | quote }}
     {{- end }}
   {{- end }}
@@ -17,15 +18,15 @@ metadata:
     #nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization"
     #nginx.ingress.kubernetes.io/cors-allow-credentials: "true"*/}}
 spec:
-  ingressClassName: {{ .Values.api.ingress.className }}
-  {{- if .Values.api.ingress.tls.enabled }}
+  ingressClassName: {{ $api.ingress.className }}
+  {{- if $api.ingress.tls.enabled }}
   tls:
     - hosts:
-        - {{ .Values.api.ingress.host }}
-      secretName: {{ default (printf "%s-api-tls" .Release.Name) .Values.api.ingress.tls.secretName }}
+        - {{ $api.ingress.host }}
+      secretName: {{ default (printf "%s-api-tls" .Release.Name) $api.ingress.tls.secretName }}
   {{- end }}
   rules:
-    - host: {{ .Values.api.ingress.host }}
+    - host: {{ $api.ingress.host }}
       http:
         paths:
           - path: /api/v1
@@ -34,5 +35,5 @@ spec:
               service:
                 name: checkmate-api
                 port:
-                  number: {{ .Values.api.port }}
+                  number: {{ $api.port }}
 {{- end }}
diff --git a/charts/helm/checkmate/templates/api/service.yaml b/charts/helm/checkmate/templates/api/service.yaml
index d172c72e8..dfea901c4 100644
--- a/charts/helm/checkmate/templates/api/service.yaml
+++ b/charts/helm/checkmate/templates/api/service.yaml
@@ -1,3 +1,4 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -6,4 +7,4 @@ spec:
   selector:
     app: checkmate-api
   ports:
-    - port: {{ .Values.api.port }}
+    - port: {{ $api.port }}
diff --git a/charts/helm/checkmate/templates/client/deployment.yaml b/charts/helm/checkmate/templates/client/deployment.yaml
index 2919dbd4d..006ccfaa1 100644
--- a/charts/helm/checkmate/templates/client/deployment.yaml
+++ b/charts/helm/checkmate/templates/client/deployment.yaml
@@ -1,3 +1,4 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -28,7 +29,7 @@ spec:
             - containerPort: {{ .Values.client.port }}
           env:
             - name: UPTIME_APP_API_BASE_URL
-              value: "{{ .Values.api.protocol }}://{{ .Values.api.ingress.host }}/api/v1"
+              value: "{{ $api.protocol }}://{{ $api.ingress.host }}/api/v1"
             - name: UPTIME_APP_CLIENT_HOST
               value: "{{ .Values.client.protocol }}://{{ .Values.client.ingress.host }}"
           volumeMounts:
diff --git a/charts/helm/checkmate/templates/client/nginx-cm.yaml b/charts/helm/checkmate/templates/client/nginx-cm.yaml
index 95d1ec936..0d23aac0a 100644
--- a/charts/helm/checkmate/templates/client/nginx-cm.yaml
+++ b/charts/helm/checkmate/templates/client/nginx-cm.yaml
@@ -1,5 +1,6 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 apiVersion: v1
-kind: ConfigMap 
+kind: ConfigMap
 metadata:
   name: checkmate-client-nginx-cm
 data:
@@ -22,7 +23,7 @@ data:
       }
 
       # location /api/ {
-      #     proxy_pass http://{{ .Values.api.ingress.host }}:5000/api/;
+      #     proxy_pass http://{{ $api.ingress.host }}:5000/api/;
       #     proxy_http_version 1.1;
       #     proxy_set_header Host $host;
       #     proxy_set_header X-Real-IP $remote_addr;
@@ -31,7 +32,7 @@ data:
       # }
 
       location /api-docs/ {
-          proxy_pass http://{{ .Values.api.ingress.host }}:5000/api-docs/;
+          proxy_pass http://{{ $api.ingress.host }}:5000/api-docs/;
           proxy_http_version 1.1;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
diff --git a/charts/helm/checkmate/templates/prechecks.yaml b/charts/helm/checkmate/templates/prechecks.yaml
index b8ff2ef11..cc9f6b9a1 100644
--- a/charts/helm/checkmate/templates/prechecks.yaml
+++ b/charts/helm/checkmate/templates/prechecks.yaml
@@ -1,12 +1,13 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 {{- if eq .Values.client.ingress.host "change_me" }}
   {{- fail "client.ingress.host must be overridden and not set to 'change_me'" }}
 {{- end }}
 
-{{- if eq .Values.api.ingress.host "change_me" }}
-  {{- fail "api.ingress.host must be overridden and not set to 'change_me'" }}
+{{- if eq $api.ingress.host "change_me" }}
+  {{- fail "api.ingress.host (or legacy server.ingress.host) must be overridden and not set to 'change_me'" }}
 {{- end }}
 
-{{- $apiProtocol := .Values.api.protocol }}
+{{- $apiProtocol := $api.protocol }}
 {{- if not (or (eq $apiProtocol "http") (eq $apiProtocol "https")) }}
   {{- fail "api.protocol must be either 'http' or 'https'" }}
 {{- end }}
@@ -21,7 +22,7 @@
   {{- fail "client.ingress.tls.enabled is true but client.protocol is not 'https'. Set client.protocol: https to avoid mixed content." }}
 {{- end }}
 
-{{- if and .Values.api.ingress.tls.enabled (ne $apiProtocol "https") }}
+{{- if and $api.ingress.tls.enabled (ne $apiProtocol "https") }}
   {{- fail "api.ingress.tls.enabled is true but api.protocol is not 'https'. Set api.protocol: https to ensure correct API base URL." }}
 {{- end }}
 
@@ -32,7 +33,7 @@
 
 {{/* Fail early if TLS enabled without cert-manager annotations (cluster-issuer or issuer) */}}
 {{- $cAnn := .Values.client.ingress.annotations | default dict }}
-{{- $aAnn := .Values.api.ingress.annotations | default dict }}
+{{- $aAnn := $api.ingress.annotations | default dict }}
 
 {{- $clientHasIssuer := or (hasKey $cAnn "cert-manager.io/cluster-issuer") (hasKey $cAnn "cert-manager.io/issuer") }}
 {{- $apiHasIssuer := or (hasKey $aAnn "cert-manager.io/cluster-issuer") (hasKey $aAnn "cert-manager.io/issuer") }}
@@ -41,7 +42,7 @@
   {{- fail "client.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
 {{- end }}
 
-{{- if and .Values.api.ingress.tls.enabled (not $apiHasIssuer) }}
+{{- if and $api.ingress.tls.enabled (not $apiHasIssuer) }}
   {{- fail "api.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
 {{- end }}
 
diff --git a/charts/helm/checkmate/templates/worker/deployment.yaml b/charts/helm/checkmate/templates/worker/deployment.yaml
index a4a76b541..1252ee8ea 100644
--- a/charts/helm/checkmate/templates/worker/deployment.yaml
+++ b/charts/helm/checkmate/templates/worker/deployment.yaml
@@ -1,3 +1,4 @@
+{{- $api := include "checkmate.api" . | fromYaml -}}
 {{- if .Values.worker.enabled }}
 apiVersion: apps/v1
 kind: Deployment
@@ -26,8 +27,8 @@ spec:
     {{- end }}
       containers:
         - name: worker
-          image: {{ .Values.worker.image | default .Values.api.image }}
-          imagePullPolicy: {{ .Values.worker.imagePullPolicy | default .Values.api.imagePullPolicy }}
+          image: {{ .Values.worker.image | default $api.image }}
+          imagePullPolicy: {{ .Values.worker.imagePullPolicy | default $api.imagePullPolicy }}
           ports:
             - name: health
               containerPort: {{ .Values.worker.healthPort }}