diff --git a/livekit-server/templates/deployment.yaml b/livekit-server/templates/deployment.yaml
index 7b35cee..1ae3880 100644
--- a/livekit-server/templates/deployment.yaml
+++ b/livekit-server/templates/deployment.yaml
@@ -60,6 +60,13 @@ spec:
             - name: LIVEKIT_TURN_KEY
               value: /etc/lkcert/tls.key
             {{- end }}
+            {{- with .Values.extraEnv }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.livekit.port }}
@@ -106,7 +113,7 @@ spec:
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) }}
+          {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) .Values.extraVolumeMounts }}
           volumeMounts:
           {{- if .Values.storeKeysInSecret.enabled }}
             - name: keys-volume
@@ -118,8 +125,11 @@ spec:
               mountPath: /etc/lkcert
               readOnly: true
           {{- end }}
+          {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- end }}
-      {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) }}
+      {{- if or .Values.storeKeysInSecret.enabled (and .Values.livekit.turn.enabled .Values.livekit.turn.tls_port (not .Values.livekit.turn.external_tls)) .Values.extraVolumes }}
       volumes:
         {{- if .Values.storeKeysInSecret.enabled }}
         - name: keys-volume
@@ -132,6 +142,9 @@ spec:
           secret:
             secretName: {{ required "tls secret required if turn enabled" .Values.livekit.turn.secretName }}
       {{- end }}
+      {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
diff --git a/livekit-server/values.yaml b/livekit-server/values.yaml
index bcf6d51..944b994 100644
--- a/livekit-server/values.yaml
+++ b/livekit-server/values.yaml
@@ -10,6 +10,38 @@ image:
 
 imagePullSecrets: []
 
+# Extra environment variables for the livekit-server container.
+# Use this to inject secrets via valueFrom.secretKeyRef without baking
+# them into the plaintext ConfigMap. LiveKit substitutes ${VAR} in its
+# YAML config at startup, so you can reference these from livekit.* below.
+extraEnv: []
+# - name: REDIS_PASSWORD
+#   valueFrom:
+#     secretKeyRef:
+#       name: my-redis-secret
+#       key: password
+
+# Extra envFrom sources (e.g. envFrom an existing Secret in bulk).
+extraEnvFrom: []
+# - secretRef:
+#     name: livecircle-external-env-secrets
+
+# Extra volumes to attach to the pod. Useful for mounting CA certificate
+# bundles, additional config files, etc.
+extraVolumes: []
+# - name: redis-ca
+#   secret:
+#     secretName: my-secret
+#     items:
+#       - key: REDIS_CA_CERT
+#         path: ca.crt
+
+# Extra volumeMounts for the livekit-server container. Pair with extraVolumes.
+extraVolumeMounts: []
+# - name: redis-ca
+#   mountPath: /etc/redis-ca
+#   readOnly: true
+
 terminationGracePeriodSeconds: 18000
 
 # configuration for livekit