diff --git a/templates/genesis/genesis-proxy.configmap.yaml b/templates/genesis/genesis-proxy.configmap.yaml
index ff150c1..c9abf10 100644
--- a/templates/genesis/genesis-proxy.configmap.yaml
+++ b/templates/genesis/genesis-proxy.configmap.yaml
@@ -11,8 +11,8 @@ data:
     http {
       map $http_upgrade $connection_upgrade { default upgrade; '' close; }
 
-      upstream genesis_ui      { server 127.0.0.1:3000; }
-      upstream genesis_backend { server 127.0.0.1:8000; }
+      upstream genesis_ui      { server 127.0.0.1:{{ .Values.ports.ui }}; }
+      upstream genesis_backend { server 127.0.0.1:{{ .Values.ports.backend }}; }
 
       server {
         listen 443 ssl;
diff --git a/templates/genesis/genesis.deployment.yaml b/templates/genesis/genesis.deployment.yaml
index c880534..c67df56 100644
--- a/templates/genesis/genesis.deployment.yaml
+++ b/templates/genesis/genesis.deployment.yaml
@@ -48,11 +48,11 @@ spec:
               valueFrom:
                 secretKeyRef:
                   key: token
-                  name: juno-auth-secret
+                  name: {{ .Values.auth.secretName }}
             - name: GALAXY
-              value: "Milky Way"
+              value: {{ .Values.galaxy | quote }}
             - name: ICON
-              value: "/universe/assets/galaxy-1.webp"
+              value: {{ .Values.icon | quote }}
           {{- if .Values.image_pull_secret }}
             - name: IMAGE_PULL_SECRET
               value: {{ .Values.image_pull_secret }}
@@ -62,9 +62,9 @@ spec:
               value: {{ $value }}
           {{- end }}
           ports:
-            - containerPort: 3000
+            - containerPort: {{ .Values.ports.ui }}
               name: frontend
-            - containerPort: 8000
+            - containerPort: {{ .Values.ports.backend }}
               name: backend
         - name: rhea
           image: "{{ .Values.rhea.image.registry }}/{{ .Values.rhea.image.repository }}:{{ .Values.rhea.image.tag }}"
diff --git a/templates/genesis/genesis.service.yaml b/templates/genesis/genesis.service.yaml
index b3d0a9b..ca45ac9 100644
--- a/templates/genesis/genesis.service.yaml
+++ b/templates/genesis/genesis.service.yaml
@@ -19,11 +19,11 @@ spec:
       protocol: TCP
       name: https
     {{- end }}
-    - port: 3000
-      targetPort: 3000
+    - port: {{ .Values.ports.ui }}
+      targetPort: {{ .Values.ports.ui }}
       protocol: TCP
       name: frontend
-    - port: 8000
-      targetPort: 8000
+    - port: {{ .Values.ports.backend }}
+      targetPort: {{ .Values.ports.backend }}
       protocol: TCP
       name: backend
diff --git a/templates/genesis/ingress.yaml b/templates/genesis/ingress.yaml
index 4c75d9e..e34595b 100644
--- a/templates/genesis/ingress.yaml
+++ b/templates/genesis/ingress.yaml
@@ -5,7 +5,7 @@ metadata:
   name: genesis-ingress
   namespace: {{ .Release.Namespace }}
   annotations:
-    nginx.ingress.kubernetes.io/auth-url: "http://genesis.{{ .Release.Namespace }}.svc.cluster.local:3000/api/socket-auth/"
+    nginx.ingress.kubernetes.io/auth-url: "http://genesis.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.ports.ui }}/api/socket-auth/"
 spec:
   ingressClassName: {{ .Values.ingressClassName }}
   rules:
@@ -18,12 +18,12 @@ spec:
               service:
                 name: genesis
                 port:
-                  number: 3000
+                  number: {{ .Values.ports.ui }}
           - path: "/socket.io"
             pathType: ImplementationSpecific
             backend:
               service:
                 name: genesis
                 port:
-                  number: 8000
+                  number: {{ .Values.ports.backend }}
 {{- end }}
\ No newline at end of file
diff --git a/values.yaml b/values.yaml
index 81a9554..56c63be 100644
--- a/values.yaml
+++ b/values.yaml
@@ -15,6 +15,23 @@ node_selector:                              # Node selector to deploy the Genesi
 extra_annotations: {}
 genesis_token_creation_extra_annotations: {}
 
+# Name of the NextAuth secret the genesis server reads the token from. Created by
+# the genesis-create-nextauth-token PreSync Job (image: /create-nextauth-secret),
+# which writes this fixed name -- only change if the image is built to honor it.
+auth:
+  secretName: juno-auth-secret
+
+# Genesis branding env, passed straight to the genesis container.
+galaxy: "Milky Way"
+icon: "/universe/assets/galaxy-1.webp"
+
+# Genesis container ports. These must match what the genesis image binds
+# internally (UI 3000, backend 8000); they are wired through the Service, the
+# in-pod nginx proxy, and the ingress, so changing one value updates all of them.
+ports:
+  ui: 3000
+  backend: 8000
+
 
 # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
 # If you run powerful controlplane nodes, you can reuse them to host core Orion services.