diff --git a/charts/patchmon/Chart.yaml b/charts/patchmon/Chart.yaml
index 934fc33..0483ae8 100644
--- a/charts/patchmon/Chart.yaml
+++ b/charts/patchmon/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: patchmon
 description: PatchMon v2 – Linux patch management platform with optional Gateway API, Postgres, Valkey, and Guacd
 type: application
-version: 0.3.2
+version: 0.3.4
 appVersion: "2.0.2"
 
 maintainers:
diff --git a/charts/patchmon/templates/postgres-statefulset.yaml b/charts/patchmon/templates/postgres-statefulset.yaml
index cb627d7..1278aee 100644
--- a/charts/patchmon/templates/postgres-statefulset.yaml
+++ b/charts/patchmon/templates/postgres-statefulset.yaml
@@ -62,10 +62,14 @@ spec:
               mountPath: /var/lib/postgresql/data
             - name: dshm
               mountPath: /dev/shm
+            - name: run
+              mountPath: /var/run/postgresql
       volumes:
         - name: dshm
           emptyDir:
             medium: Memory
+        - name: run
+          emptyDir: {}
       {{- with .Values.postgres.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/charts/patchmon/templates/secret.yaml b/charts/patchmon/templates/secret.yaml
index 91b44d3..0bdf592 100644
--- a/charts/patchmon/templates/secret.yaml
+++ b/charts/patchmon/templates/secret.yaml
@@ -42,8 +42,8 @@ stringData:
   POSTGRES_PASSWORD: {{ default (randAlphaNum 32) $oldPg | quote }}
 {{- end }}
   JWT_SECRET: {{ default (randAlphaNum 64) (default $oldJwt .Values.patchmon.jwt.secret) | quote }}
-  SESSION_SECRET: {{ default (randAlphaNum 64) $oldSession | quote }}
-  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) $oldAiKey | quote }}
+  SESSION_SECRET: {{ default (randAlphaNum 64) (default $oldSession .Values.patchmon.session.secret) | quote }}
+  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey .Values.patchmon.encryption.aiKey) | quote }}
 {{- if .Values.valkey.auth.enabled }}
   REDIS_PASSWORD: {{ default (randAlphaNum 32) $oldRedis | quote }}
 {{- end }}
diff --git a/charts/patchmon/values.yaml b/charts/patchmon/values.yaml
index 2341afe..0bfcca4 100644
--- a/charts/patchmon/values.yaml
+++ b/charts/patchmon/values.yaml
@@ -94,6 +94,18 @@ patchmon:
     secret: ""
     expiresIn: "1h"
 
+  session:
+    # If empty, a random value is generated and persisted in the Secret via lookup.
+    # Note: the lookup fallback only works with `helm upgrade`/`install` against a live
+    # cluster — GitOps controllers that render via `helm template` (e.g. ArgoCD) always
+    # see an empty lookup result, so leaving this blank there means a new random value
+    # (and pod restart via the checksum/secret annotation) on every render.
+    secret: ""
+
+  encryption:
+    # Same lookup caveat as patchmon.session.secret above.
+    aiKey: ""
+
   auth:
     maxLoginAttempts: 5
     lockoutDurationMinutes: 15