diff --git a/helm/codeapi/README.md b/helm/codeapi/README.md
index f63950ae..ca30afc7 100644
--- a/helm/codeapi/README.md
+++ b/helm/codeapi/README.md
@@ -197,8 +197,9 @@ api:
 For development only, `LOCAL_MODE=true` bypasses authentication — see
 `values-local.yaml`.
 
-**TLS to Redis.** Set `REDIS_TLS=true` via `extraEnv` on each component when
-your Redis (e.g. a managed cache) requires TLS.
+**TLS to Redis.** Set `REDIS_TLS=true` via `extraEnv` on each component that
+connects to Redis (`api`, `workerSandbox`, `fileServer`, `toolCallServer` and
+`egressGateway`) when your Redis (e.g. a managed cache) requires TLS.
 
 **Package delivery.** KVM deployments default to
 `workerSandbox.packages.source=image`. Build and publish the baked runner target
diff --git a/helm/codeapi/templates/egress-gateway-deployment.yaml b/helm/codeapi/templates/egress-gateway-deployment.yaml
index 941844ce..22efbd88 100644
--- a/helm/codeapi/templates/egress-gateway-deployment.yaml
+++ b/helm/codeapi/templates/egress-gateway-deployment.yaml
@@ -83,6 +83,9 @@ spec:
                 secretKeyRef:
                   name: {{ include "codeapi.fullname" . }}-secrets
                   key: redis-password
+            {{- with .Values.egressGateway.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /live
diff --git a/helm/codeapi/templates/file-server-deployment.yaml b/helm/codeapi/templates/file-server-deployment.yaml
index 1a9e8531..d21c05ad 100644
--- a/helm/codeapi/templates/file-server-deployment.yaml
+++ b/helm/codeapi/templates/file-server-deployment.yaml
@@ -122,6 +122,9 @@ spec:
             # Server config
             - name: FILE_SERVER_PORT
               value: {{ .Values.fileServer.service.port | quote }}
+            {{- with .Values.fileServer.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /health
diff --git a/helm/codeapi/templates/tool-call-server-deployment.yaml b/helm/codeapi/templates/tool-call-server-deployment.yaml
index b5596c90..9bd5520b 100644
--- a/helm/codeapi/templates/tool-call-server-deployment.yaml
+++ b/helm/codeapi/templates/tool-call-server-deployment.yaml
@@ -56,6 +56,9 @@ spec:
               value: {{ .Values.toolCallServer.config.requestTimeout | quote }}
             - name: TOOL_CALL_SESSION_EXPIRY
               value: {{ .Values.toolCallServer.config.sessionExpiry | quote }}
+            {{- with .Values.toolCallServer.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /health
diff --git a/helm/codeapi/values.yaml b/helm/codeapi/values.yaml
index 33c32af0..06220c5f 100644
--- a/helm/codeapi/values.yaml
+++ b/helm/codeapi/values.yaml
@@ -380,6 +380,9 @@ fileServer:
     # Use IRSA for authentication (no static credentials needed)
     useIrsa: false
 
+  # Extra environment variables
+  extraEnv: []
+
 # =============================================================================
 # TOOL CALL SERVER (programmatic tool calling, stateless)
 # =============================================================================
@@ -408,6 +411,9 @@ toolCallServer:
     requestTimeout: 300000
     sessionExpiry: 600
 
+  # Extra environment variables
+  extraEnv: []
+
 # =============================================================================
 # EGRESS GATEWAY (only sandbox-runner outbound capability endpoint)
 # =============================================================================
@@ -435,6 +441,9 @@ egressGateway:
   config:
     maxToolCallBytes: 1048576
 
+  # Extra environment variables
+  extraEnv: []
+
 # =============================================================================
 # REDIS (Job queue and state store)
 # =============================================================================