diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index 50792df..7c98c0f 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -5,7 +5,7 @@ description: A Gradle Build Cache server with Redis backend for EduIDE deploymen
 type: application
 
 # Bump this version on every release — also used as the Docker image tag
-version: 0.5.0
+version: 0.5.2
 
 dependencies:
   - name: reposilite
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
index c15c2c8..3cf35b3 100644
--- a/chart/templates/_helpers.tpl
+++ b/chart/templates/_helpers.tpl
@@ -12,3 +12,31 @@ helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
 app.kubernetes.io/name: {{ .Chart.Name }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
+
+{{/*
+Resolve the cache hostname: explicit gateway.cache.hostname wins,
+otherwise derive `cache.<gateway.baseHost>`.
+*/}}
+{{- define "eduide-shared-cache.cacheHostname" -}}
+{{- if .Values.gateway.cache.hostname -}}
+{{ .Values.gateway.cache.hostname }}
+{{- else if .Values.gateway.baseHost -}}
+cache.{{ .Values.gateway.baseHost }}
+{{- else -}}
+{{ fail "Set gateway.baseHost or gateway.cache.hostname" }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Resolve the repo hostname: explicit gateway.repo.hostname wins,
+otherwise derive `repo.<gateway.baseHost>`.
+*/}}
+{{- define "eduide-shared-cache.repoHostname" -}}
+{{- if .Values.gateway.repo.hostname -}}
+{{ .Values.gateway.repo.hostname }}
+{{- else if .Values.gateway.baseHost -}}
+repo.{{ .Values.gateway.baseHost }}
+{{- else -}}
+{{ fail "Set gateway.baseHost or gateway.repo.hostname" }}
+{{- end -}}
+{{- end -}}
diff --git a/chart/templates/httproute-cache.yaml b/chart/templates/httproute-cache.yaml
new file mode 100644
index 0000000..e312520
--- /dev/null
+++ b/chart/templates/httproute-cache.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Chart.Name }}-cache
+  labels:
+    {{- include "eduide-shared-cache.labels" . | nindent 4 }}
+    app.kubernetes.io/component: cache-server
+spec:
+  parentRefs:
+    {{- if .Values.gateway.parentRefs.cache }}
+    {{- toYaml .Values.gateway.parentRefs.cache | nindent 4 }}
+    {{- else }}
+    {{- fail "gateway.parentRefs.cache must be set when gateway.enabled is true" }}
+    {{- end }}
+  hostnames:
+    - {{ include "eduide-shared-cache.cacheHostname" . | quote }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ .Chart.Name }}
+          port: 8080
+{{- end }}
diff --git a/chart/templates/httproute-repo.yaml b/chart/templates/httproute-repo.yaml
new file mode 100644
index 0000000..13644bd
--- /dev/null
+++ b/chart/templates/httproute-repo.yaml
@@ -0,0 +1,26 @@
+{{- if and .Values.gateway.enabled .Values.reposilite.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Chart.Name }}-repo
+  labels:
+    {{- include "eduide-shared-cache.labels" . | nindent 4 }}
+    app.kubernetes.io/component: dependency-cache
+spec:
+  parentRefs:
+    {{- if .Values.gateway.parentRefs.repo }}
+    {{- toYaml .Values.gateway.parentRefs.repo | nindent 4 }}
+    {{- else }}
+    {{- fail "gateway.parentRefs.repo must be set when gateway.enabled is true and reposilite.enabled is true" }}
+    {{- end }}
+  hostnames:
+    - {{ include "eduide-shared-cache.repoHostname" . | quote }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ .Values.reposilite.fullnameOverride | default (printf "%s-reposilite" .Release.Name) }}
+          port: 8080
+{{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
index bd4bd59..011e0c7 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -33,6 +33,49 @@ tls:
   # Kubernetes secret name containing tls.crt and tls.key
   secretName: ""
 
+# ============================================================
+# Gateway API (HTTPRoutes only)
+# ============================================================
+#
+# This chart does NOT create a Gateway. It expects one to already exist
+# (e.g. the shared `theia-shared-gateway` in the `gateway-system` namespace)
+# with listeners configured for the hostnames below.
+#
+# Before installing with gateway.enabled=true, the cluster operator must:
+#   1. Add a listener per hostname on the shared Gateway, each with a TLS cert.
+#   2. Point DNS for those hostnames at the shared Gateway's load balancer IP.
+
+gateway:
+  # -- Render HTTPRoute resources. Disable to skip all Gateway API wiring.
+  enabled: false
+
+  # -- Environment base host. Hostnames default to:
+  #   cache.<baseHost>  and  repo.<baseHost>
+  # e.g. baseHost: test2.theia-test.artemis.cit.tum.de
+  baseHost: ""
+
+  # -- parentRefs for the HTTPRoutes. Each route attaches to one listener
+  # on the shared Gateway via `sectionName`. The listener's hostname on
+  # the Gateway must match the route's effective hostname.
+  # Example:
+  #   cache:
+  #     - name: theia-shared-gateway
+  #       namespace: gateway-system
+  #       sectionName: test2-cache
+  #   repo:
+  #     - name: theia-shared-gateway
+  #       namespace: gateway-system
+  #       sectionName: test2-repo
+  parentRefs:
+    cache: []
+    repo: []
+
+  # -- Optional explicit hostname overrides. Leave empty to derive from baseHost.
+  cache:
+    hostname: ""
+  repo:
+    hostname: ""
+
 resources:
   requests:
     memory: "256Mi"
@@ -70,6 +113,10 @@ monitoring:
 reposilite:
   enabled: true
 
+  # Override the full name of the Reposilite release (controls the service name).
+  # The HTTPRoute backend ref uses this same value.
+  fullnameOverride: "eduide-shared-cache-reposilite"
+
   # Admin access token for Reposilite management
   adminToken: "changeme"