diff --git a/apps/attachments/vad/kustomization.yaml b/apps/attachments/vad/kustomization.yaml
index 27bb5cb..09b1eed 100644
--- a/apps/attachments/vad/kustomization.yaml
+++ b/apps/attachments/vad/kustomization.yaml
@@ -1,4 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: attachments
 resources:
   - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: attachments
diff --git a/apps/attachments/vad/patch.yaml b/apps/attachments/vad/patch.yaml
new file mode 100644
index 0000000..5f8e859
--- /dev/null
+++ b/apps/attachments/vad/patch.yaml
@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+spec:
+  values:
+    services:
+      attachments:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: attachments
+            vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
+            vault.hashicorp.com/agent-inject-template-attachments-db: |-
+              {{- with secret "secrets/data/apps/attachments/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              DATABASE_SSL_MODE=disable
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
+            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
+              {{- with secret "secrets/data/minio/apps/attachments" -}}
+              YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
+              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YANDEX_S3_USE_SSL=false
+              YANDEX_S3_REGION=ru-central
+              YANDEX_S3_VERIFY=false
+              BUCKET_NAME=attachments
+              {{- end -}}
diff --git a/apps/bi/vad/backend.yaml b/apps/bi/vad/backend.yaml
new file mode 100644
index 0000000..c473385
--- /dev/null
+++ b/apps/bi/vad/backend.yaml
@@ -0,0 +1,74 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-backend
+  namespace: bi
+spec:
+  values:
+    services:
+      main:
+        envs:
+          - name: SETTINGS_DEBUG
+            value:
+              _default: "0"
+
+          - name: SETTINGS_VERIFY_SSL
+            value:
+              _default: "1"
+
+          - name: SETTINGS_API_V1_PREFIX
+            value:
+              _default: "/api/v1"
+
+          - name: AUTH_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
+          - name: WORKER_TIMEOUT
+            value:
+              _default: "120"
+
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://sarex-bi.vadroad.ru/"
+
+          - name: PYTHONPATH
+            value:
+              _default: "src"
+
+          - name: ISSUES_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.issues.svc.cluster.local"
+
+          - name: EAV_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local"
+
+          - name: PM_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.pm.svc.cluster.local:8000"
+
+          - name: SUPERSET_SYSTEM_WIDGETS
+            value:
+              _default: '{"MDR": {"id": "e7343f21-1ee0-4a87-b712-e8cfd413cc49","name": "MDR"},"SC": {"id": "d63d25e4-eab6-452f-8b31-065094bc2cb6","name": "Стройконтроль"}}'
+
+          - name: SUPERSET_DOCUMENTATION_URL
+            value:
+              _default: "https://sarex.vadroad.ru/documentations/"
+          
+          - name: SUPERSET_JWT_SECRET
+            value:
+              _default: "6TosZjqxxZ3kAPiht4miaGICRV5AbfvuenWnYfOUnxfbYJJXUNWedOS0QeJQaryr"
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-prod"}'
+
+          - name: KAFKA_ENABLE
+            value:
+              _default: "0"
diff --git a/apps/bi/vad/kustomization.yaml b/apps/bi/vad/kustomization.yaml
index 27bb5cb..01b4d58 100644
--- a/apps/bi/vad/kustomization.yaml
+++ b/apps/bi/vad/kustomization.yaml
@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-backend
diff --git a/apps/django/vad/backend.yaml b/apps/django/vad/backend.yaml
new file mode 100644
index 0000000..a42b6bb
--- /dev/null
+++ b/apps/django/vad/backend.yaml
@@ -0,0 +1,158 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.vadroad.ru
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.vadroad.ru
+          - name: WORKFLOWS_HOST
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: WORKFLOWS_PREFIX
+            value:
+              _default: /internal/v1
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://sarex-login.vadroad.ru
+          # Включено вместе с message-hub: он консьюмер топика message-hub-stage
+          # (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml),
+          # а писать в этот топик должен django. Vault-шаблон django-kafka
+          # и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг.
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-django-s3: |-
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- $buckets := index .Data.data "buckets" }}
+              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              S3_LOGIN={{ index .Data.data "access_key" }}
+              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              {{- end }}
diff --git a/apps/django/vad/kustomization.yaml b/apps/django/vad/kustomization.yaml
index a433cb3..aa93fd8 100644
--- a/apps/django/vad/kustomization.yaml
+++ b/apps/django/vad/kustomization.yaml
@@ -7,3 +7,15 @@ patches:
     target:
       kind: ConfigMap
       name: nginx-configmap
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: zitadel-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: zitadel-configmap
+  - path: s3-proxy.yaml
+    target:
+      kind: HelmRelease
+      name: s3-proxy
diff --git a/apps/django/vad/s3-proxy.yaml b/apps/django/vad/s3-proxy.yaml
new file mode 100644
index 0000000..7d52fba
--- /dev/null
+++ b/apps/django/vad/s3-proxy.yaml
@@ -0,0 +1,31 @@
+---
+# Патч s3-proxy для vad.
+#
+# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
+# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO
+# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку.
+#
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# agent-inject-template-s3; остальные vault-аннотации берутся из base.
+# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же
+# сделано в apps/django/vad/backend.yaml для того же секрета
+# secrets/data/minio/apps/django — держим один способ на весь ns.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+spec:
+  values:
+    services:
+      s3-proxy:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-s3: |
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_API_ENDPOINT=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- $buckets := index .Data.data "buckets" }}
+              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end }}
diff --git a/apps/django/vad/zitadel-configmap.yaml b/apps/django/vad/zitadel-configmap.yaml
new file mode 100644
index 0000000..631cd7f
--- /dev/null
+++ b/apps/django/vad/zitadel-configmap.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-configmap
+  namespace: django
+data:
+  config.json: |
+    {
+      "auth_type": "zitadel",
+      "zitadel": {
+        "client_id": "placeholder-needs-real-zitadel-oidc-client-id",
+        "host": "https://sarex-login.vadroad.ru"
+      }
+    }
diff --git a/apps/documentations/vad/api.yaml b/apps/documentations/vad/api.yaml
new file mode 100644
index 0000000..4655e83
--- /dev/null
+++ b/apps/documentations/vad/api.yaml
@@ -0,0 +1,158 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: sarex-login.vadroad.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.vadroad.ru/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.vadroad.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://backend-svc.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: "true"
+          - name: MARKS_RABBITMQ_HOST
+            value:
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+          - name: MARKS_RABBITMQ_PORT
+            value:
+              _default: "5672"
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://sarex-document-link.vadroad.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "true"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "false"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
diff --git a/apps/documentations/vad/filestream.yaml b/apps/documentations/vad/filestream.yaml
new file mode 100644
index 0000000..d31e3e1
--- /dev/null
+++ b/apps/documentations/vad/filestream.yaml
@@ -0,0 +1,146 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: sarex-login.vadroad.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.vadroad.ru/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.vadroad.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://sarex-document-link.vadroad.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
diff --git a/apps/documentations/vad/kustomization.yaml b/apps/documentations/vad/kustomization.yaml
index 27bb5cb..9931dec 100644
--- a/apps/documentations/vad/kustomization.yaml
+++ b/apps/documentations/vad/kustomization.yaml
@@ -2,3 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: api.yaml
+    target:
+      kind: HelmRelease
+      name: documentations-api
+  - path: filestream.yaml
+    target:
+      kind: HelmRelease
+      name: documentations-filestream
diff --git a/apps/flows/vad/backend.yaml b/apps/flows/vad/backend.yaml
new file mode 100644
index 0000000..96025d1
--- /dev/null
+++ b/apps/flows/vad/backend.yaml
@@ -0,0 +1,167 @@
+---
+# Патч backend для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: flows
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
+                [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
+                [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
+                [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
+                [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
+                [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
+                set +a
+                exec /opt/entrypoint.sh
+
+        envs:
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80/api"
+
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "sarex@vadroad.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-svc.documentations.svc.cluster.local:80"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://sarex.vadroad.ru/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "post.vadroad.ru"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
+          - name: SMTP_PORT
+            value:
+              _default: "587"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
+                NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
+                h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
+                D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
+                tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
+                Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
+                GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
+                A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
+                QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
+                KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
+                kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
+                TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
+                fdA17/ibw6gFrH2b3vZKcx8D455V
+                -----END CERTIFICATE-----
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
+            vault.hashicorp.com/agent-inject-template-flows-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/flows" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
diff --git a/apps/flows/vad/celery.yaml b/apps/flows/vad/celery.yaml
new file mode 100644
index 0000000..1ca93e9
--- /dev/null
+++ b/apps/flows/vad/celery.yaml
@@ -0,0 +1,168 @@
+---
+# Патч celery для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: flows
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
+                [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
+                [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
+                [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
+                [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
+                [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
+                set +a
+                exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow
+
+        envs:
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80/api"
+
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "sarex@vadroad.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://sarex.vadroad.ru/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "post.vadroad.ru"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
+          - name: SMTP_PORT
+            value:
+              _default: "587"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+          # См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml.
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
+                NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
+                h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
+                D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
+                tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
+                Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
+                GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
+                A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
+                QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
+                KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
+                kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
+                TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
+                fdA17/ibw6gFrH2b3vZKcx8D455V
+                -----END CERTIFICATE-----
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
+            vault.hashicorp.com/agent-inject-template-flows-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/flows" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
diff --git a/apps/flows/vad/kustomization.yaml b/apps/flows/vad/kustomization.yaml
index 27bb5cb..db56240 100644
--- a/apps/flows/vad/kustomization.yaml
+++ b/apps/flows/vad/kustomization.yaml
@@ -2,3 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
diff --git a/apps/iam/vad/backend-s3.yaml b/apps/iam/vad/backend-s3.yaml
new file mode 100644
index 0000000..024338a
--- /dev/null
+++ b/apps/iam/vad/backend-s3.yaml
@@ -0,0 +1,78 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: iam-backend
+  namespace: iam
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "debug"
+
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: HTTP_READ_BUFFER_SIZE
+            value:
+              _default: "131072"
+
+          - name: DB_MIGRATIONS_PATH
+            value:
+              _default: "migrations"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://sarex-login.vadroad.ru"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: S3_ENABLED
+            value:
+              _default: "true"
+
+          - name: S3_ENDPOINT_URL
+            value:
+              _default: "http://s3-proxy.s3-proxy.svc.cluster.local"
+
+          - name: S3_BUCKET_NAME
+            value:
+              _default: "iam"
+
+          - name: S3_REGION
+            value:
+              _default: "ru-central1"
+
+          - name: S3_PRESIGN_EXPIRES
+            value:
+              _default: "1h"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "false"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/etc/ca-certificates/Yandex/ca-cert"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"
diff --git a/apps/iam/vad/kustomization.yaml b/apps/iam/vad/kustomization.yaml
index 27bb5cb..a75a677 100644
--- a/apps/iam/vad/kustomization.yaml
+++ b/apps/iam/vad/kustomization.yaml
@@ -1,4 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: iam
 resources:
   - ../base
+patches:
+  - path: backend-s3.yaml
+    target:
+      kind: HelmRelease
+      name: iam-backend
diff --git a/apps/issues/vad/backend-s3.yaml b/apps/issues/vad/backend-s3.yaml
new file mode 100644
index 0000000..a84b217
--- /dev/null
+++ b/apps/issues/vad/backend-s3.yaml
@@ -0,0 +1,149 @@
+---
+# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
+# podAnnotations — map, мержится по ключам.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: issues
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
+                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
+                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
+                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
+                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
+                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
+                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
+                set +a
+                exec /src/entrypoint.sh
+
+        volumes:
+          _default:
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
+          # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
+          # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          # Топики совпадают с тем, что уже провижено на брокере (см. topics
+          # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
+          - name: KAFKA_ISSUES_TOPIC
+            value:
+              _default: "issues_broadcast_prod"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/issues" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
diff --git a/apps/issues/vad/celery-s3.yaml b/apps/issues/vad/celery-s3.yaml
new file mode 100644
index 0000000..57dd8c2
--- /dev/null
+++ b/apps/issues/vad/celery-s3.yaml
@@ -0,0 +1,145 @@
+---
+# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
+# podAnnotations — map, мержится по ключам.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: issues
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
+                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
+                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
+                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
+                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
+                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
+                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
+                set +a
+                exec celery -A config worker -l info -E
+
+        volumes:
+          _default:
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_ISSUES_TOPIC
+            value:
+              _default: "issues_broadcast_prod"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/issues" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
diff --git a/apps/issues/vad/kafka-ca-configmap.yaml b/apps/issues/vad/kafka-ca-configmap.yaml
new file mode 100644
index 0000000..9424d65
--- /dev/null
+++ b/apps/issues/vad/kafka-ca-configmap.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: issues
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
+    NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
+    h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
+    D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
+    tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
+    Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
+    GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
+    A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
+    QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
+    KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
+    kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
+    TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
+    fdA17/ibw6gFrH2b3vZKcx8D455V
+    -----END CERTIFICATE-----
diff --git a/apps/issues/vad/kustomization.yaml b/apps/issues/vad/kustomization.yaml
index 27bb5cb..efeb88f 100644
--- a/apps/issues/vad/kustomization.yaml
+++ b/apps/issues/vad/kustomization.yaml
@@ -2,3 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - kafka-ca-configmap.yaml
+patches:
+  - path: backend-s3.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: celery-s3.yaml
+    target:
+      kind: HelmRelease
+      name: celery
diff --git a/apps/transmittal/vad/backend.yaml b/apps/transmittal/vad/backend.yaml
new file mode 100644
index 0000000..1ce3dcd
--- /dev/null
+++ b/apps/transmittal/vad/backend.yaml
@@ -0,0 +1,247 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: transmittal
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: TRANSMITTAL_SERVICE_APP__NAME
+            value:
+              _default: "Transmittal Service"
+
+          - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+            value:
+              _default: "ERROR"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-svc.flows.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTAL_SERVICE_APP__HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech/transmittal"
+
+          - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__PORT
+            value:
+              _default: "8000"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__ENABLE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__HOST
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
+            value:
+              _default: "backend.transmittals-prod"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__INSECURE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
+            value:
+              _default: "verify-full"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
+            value:
+              _default: "/opt/.postgresql/root.crt"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
+            value:
+              _default: "2"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
+            value:
+              _default: ""
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
+            value:
+              _default: "5672"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
+            value:
+              _default: "ru-central1"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
+            value:
+              _default: "s3-proxy.s3-proxy.svc.cluster.local"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
+            value:
+              _default: "http://marks-service.documentations.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL
+            value:
+              _default: "https://api.mailgun.net/v3/mg.sarex.io"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
+            value:
+              _default: "hello@wb.io"
+
diff --git a/apps/transmittal/vad/kustomization.yaml b/apps/transmittal/vad/kustomization.yaml
index 27bb5cb..db8bbe1 100644
--- a/apps/transmittal/vad/kustomization.yaml
+++ b/apps/transmittal/vad/kustomization.yaml
@@ -2,3 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: worker.yaml
+    target:
+      kind: HelmRelease
+      name: worker
diff --git a/apps/transmittal/vad/worker.yaml b/apps/transmittal/vad/worker.yaml
new file mode 100644
index 0000000..c09e03b
--- /dev/null
+++ b/apps/transmittal/vad/worker.yaml
@@ -0,0 +1,247 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: worker
+  namespace: transmittal
+spec:
+  values:
+    services:
+      worker:
+        envs:
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-svc.flows.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTAL_SERVICE_APP__NAME
+            value:
+              _default: "Transmittal Service"
+
+          - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+            value:
+              _default: "ERROR"
+
+          - name: TRANSMITTAL_SERVICE_APP__HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/transmittal"
+
+          - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__PORT
+            value:
+              _default: "8000"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__ENABLE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__HOST
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
+            value:
+              _default: "backend.transmittals-prod"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__INSECURE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
+            value:
+              _default: "verify-full"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
+            value:
+              _default: "/opt/.postgresql/root.crt"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
+            value:
+              _default: "2"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
+            value:
+              _default: ""
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
+            value:
+              _default: "5672"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
+            value:
+              _default: "ru-central1"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
+            value:
+              _default: "s3-proxy.s3-proxy.svc.cluster.local"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
+            value:
+              _default: "http://marks-service.documentations.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL
+            value:
+              _default: "https://api.mailgun.net/v3/mg.sarex.io"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
+            value:
+              _default: "hello@wb.io"
+