diff --git a/.claude/worktrees/agent-aa1cfa7f b/.claude/worktrees/agent-aa1cfa7f
deleted file mode 160000
index 5bb7e57109..0000000000
--- a/.claude/worktrees/agent-aa1cfa7f
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 5bb7e571093750dfe0c693e30769499455682eb5
diff --git a/.claude/worktrees/k8s-mcp-docs b/.claude/worktrees/k8s-mcp-docs
deleted file mode 160000
index c030c26476..0000000000
--- a/.claude/worktrees/k8s-mcp-docs
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit c030c26476233a54212041e2d5ff6c0a6440eaad
diff --git a/.claude/worktrees/litellm-1.83.3-bump b/.claude/worktrees/litellm-1.83.3-bump
deleted file mode 160000
index e270ea6608..0000000000
--- a/.claude/worktrees/litellm-1.83.3-bump
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit e270ea660817d8250981f168557a59a48d29735e
diff --git a/.gitignore b/.gitignore
index 7ede1044b9..3bddd6bae4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@ tmp/
 config.yaml
 checks.yaml
 .claude/skills/dev-skills/
+.claude/worktrees/
 
 # Byte-compiled / optimized / DLL files
 __pycache__/
diff --git a/helm/holmes/templates/_helpers.tpl b/helm/holmes/templates/_helpers.tpl
index 54292069e7..fcfe8b2e10 100644
--- a/helm/holmes/templates/_helpers.tpl
+++ b/helm/holmes/templates/_helpers.tpl
@@ -42,3 +42,37 @@ true
 false
 {{- end -}}
 {{- end -}}
+
+{{/*
+Common annotations to apply to all objects created by this chart.
+Usage: {{- include "holmes.commonAnnotations" . | nindent 4 }}
+*/}}
+{{- define "holmes.commonAnnotations" -}}
+{{- range $key, $val := .Values.commonAnnotations }}
+{{ $key | toYaml }}: {{ $val | toString | toYaml }}
+{{- end }}
+{{- end }}
+
+{{/*
+Common labels to apply to all objects created by this chart.
+Reserved keys used in selector.matchLabels are rejected to prevent
+Deployment reconciliation failures caused by label divergence.
+Usage: {{- include "holmes.commonLabels" . | nindent 4 }}
+*/}}
+{{- define "holmes.commonLabels" -}}
+{{- $reserved := list
+    "app"
+    "app.kubernetes.io/name"
+    "app.kubernetes.io/instance"
+    "app.kubernetes.io/component"
+    "app.kubernetes.io/part-of"
+    "app.kubernetes.io/managed-by" -}}
+{{- with .Values.commonLabels }}
+{{- range $key, $val := . }}
+{{- if has $key $reserved }}
+{{- fail (printf "commonLabels: key %q is reserved and cannot be overridden" $key) }}
+{{- end }}
+{{ $key | toYaml }}: {{ $val | toString | toYaml }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/helm/holmes/templates/holmes.yaml b/helm/holmes/templates/holmes.yaml
index d2ae4a12c0..54aa2d759b 100644
--- a/helm/holmes/templates/holmes.yaml
+++ b/helm/holmes/templates/holmes.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   {{- if (not .Values.autoscaling.enabled) }}
   replicas: {{ .Values.replicas }}
@@ -21,12 +26,16 @@ spec:
     metadata:
       labels:
         app: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
-        # checksum annotation triggering pod reload when .Values.toolsets changes by helm upgrade
-        checksum/toolset-config: {{ list .Values.toolsets .Values.modelList .Values.mcp_servers | toYaml | sha256sum }}
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+        # checksum annotation triggering pod reload when .Values.toolsets changes by helm upgrade
+        checksum/toolset-config: {{ list .Values.toolsets .Values.modelList .Values.mcp_servers | toYaml | sha256sum }}
     spec:
       serviceAccountName: {{ include "holmes.serviceAccountName" . }}
       {{- if .Values.imagePullSecrets }}
@@ -181,6 +190,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: holmes
diff --git a/helm/holmes/templates/holmesgpt-service-account.yaml b/helm/holmes/templates/holmesgpt-service-account.yaml
index a2a331f08e..4bc516b610 100644
--- a/helm/holmes/templates/holmesgpt-service-account.yaml
+++ b/helm/holmes/templates/holmesgpt-service-account.yaml
@@ -4,6 +4,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ .Release.Name }}-holmes-cluster-role
   namespace : {{ .Release.Namespace }}
+  {{- with (include "holmes.commonLabels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 rules:
   {{- if .Values.customClusterRoleRules }}
 {{ toYaml .Values.customClusterRoleRules | indent 2 }}
@@ -412,11 +420,20 @@ kind: ServiceAccount
 metadata:
   name: {{ include "holmes.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAccount.annotations }}
-  annotations:
-  {{- with .Values.serviceAccount.annotations }}
-    {{- toYaml . | nindent 4}}
+  {{- with (include "holmes.commonLabels" .) }}
+  labels:
+    {{- . | nindent 4 }}
   {{- end }}
+  {{- $ann := dict -}}
+  {{- with (include "holmes.commonAnnotations" . | fromYaml) -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- with .Values.serviceAccount.annotations -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- if $ann }}
+  annotations:
+    {{- toYaml $ann | nindent 4 }}
   {{- end }}
 {{- if .Values.serviceAccount.imagePullSecrets }}
 imagePullSecrets:
@@ -427,6 +444,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ .Release.Name }}-holmes-cluster-role-binding
+  {{- with (include "holmes.commonLabels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -441,6 +466,14 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ .Release.Name }}-holmes-cluster-monitoring
+  {{- with (include "holmes.commonLabels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "holmes.serviceAccountName" . }}
diff --git a/helm/holmes/templates/hpa.yaml b/helm/holmes/templates/hpa.yaml
index f090dee866..32ec900c96 100644
--- a/helm/holmes/templates/hpa.yaml
+++ b/helm/holmes/templates/hpa.yaml
@@ -6,6 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
diff --git a/helm/holmes/templates/mcp-servers/aws/deployment.yaml b/helm/holmes/templates/mcp-servers/aws/deployment.yaml
index d706cb1f8b..38a1ad6041 100644
--- a/helm/holmes/templates/mcp-servers/aws/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/aws/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   AWS_REGION: {{ .Values.mcpAddons.aws.config.region | quote }}
   READ_OPERATIONS_ONLY: {{ .Values.mcpAddons.aws.config.readOnlyMode | quote }}
@@ -40,9 +45,17 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
-  {{- if and .Values.mcpAddons.aws.serviceAccount.annotations (not (and .Values.mcpAddons.aws.multiAccount.enabled .Values.mcpAddons.aws.multiAccount.profiles)) }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- $ann := dict -}}
+  {{- with (include "holmes.commonAnnotations" . | fromYaml) -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- if and .Values.mcpAddons.aws.serviceAccount.annotations (not (and .Values.mcpAddons.aws.multiAccount.enabled .Values.mcpAddons.aws.multiAccount.profiles)) -}}
+  {{- $ann = mergeOverwrite $ann .Values.mcpAddons.aws.serviceAccount.annotations -}}
+  {{- end -}}
+  {{- if $ann }}
   annotations:
-    {{- toYaml .Values.mcpAddons.aws.serviceAccount.annotations | nindent 4 }}
+    {{- toYaml $ann | nindent 4 }}
   {{- end }}
 {{- end }}
 ---
@@ -57,6 +70,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -72,7 +90,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.aws | toYaml | sha256sum }}
     spec:
       serviceAccountName: {{ .Values.mcpAddons.aws.serviceAccount.name }}
@@ -182,6 +204,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-aws-mcp
diff --git a/helm/holmes/templates/mcp-servers/aws/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/aws/networkpolicy.yaml
index 80391ae73c..6568c70952 100644
--- a/helm/holmes/templates/mcp-servers/aws/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/aws/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/azure/deployment.yaml b/helm/holmes/templates/mcp-servers/azure/deployment.yaml
index f1507e5d8b..f88964720d 100644
--- a/helm/holmes/templates/mcp-servers/azure/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/azure/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   AZURE_TENANT_ID: {{ .Values.mcpAddons.azure.config.tenantId | quote }}
   AZURE_SUBSCRIPTION_ID: {{ .Values.mcpAddons.azure.config.subscriptionId | quote }}
@@ -29,12 +34,20 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
     {{- if eq .Values.mcpAddons.azure.config.authMethod "workload-identity" }}
     azure.workload.identity/use: "true"
     {{- end }}
-  {{- if .Values.mcpAddons.azure.serviceAccount.annotations }}
+  {{- $ann := dict -}}
+  {{- with (include "holmes.commonAnnotations" . | fromYaml) -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- with .Values.mcpAddons.azure.serviceAccount.annotations -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- if $ann }}
   annotations:
-    {{- toYaml .Values.mcpAddons.azure.serviceAccount.annotations | nindent 4 }}
+    {{- toYaml $ann | nindent 4 }}
   {{- end }}
 {{- end }}
 ---
@@ -49,6 +62,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -64,9 +82,15 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
         {{- if eq .Values.mcpAddons.azure.config.authMethod "workload-identity" }}
         azure.workload.identity/use: "true"
         {{- end }}
+      annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+          {{- . | nindent 8 }}
+        {{- end }}
+        checksum/config: {{ .Values.mcpAddons.azure | toYaml | sha256sum }}
     spec:
       {{- if or .Values.mcpAddons.azure.serviceAccount.create .Values.mcpAddons.azure.serviceAccount.name }}
       serviceAccountName: {{ .Values.mcpAddons.azure.serviceAccount.name }}
@@ -185,6 +209,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   type: ClusterIP
   selector:
diff --git a/helm/holmes/templates/mcp-servers/azure/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/azure/networkpolicy.yaml
index 76cae0327f..284622351c 100644
--- a/helm/holmes/templates/mcp-servers/azure/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/azure/networkpolicy.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/confluence-mcp/deployment.yaml b/helm/holmes/templates/mcp-servers/confluence-mcp/deployment.yaml
index 66c98e804b..834428a8eb 100644
--- a/helm/holmes/templates/mcp-servers/confluence-mcp/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/confluence-mcp/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   TRANSPORT: "sse"
   CONFLUENCE_URL: {{ required "mcpAddons.confluenceMcp.config.url is required" .Values.mcpAddons.confluenceMcp.config.url | quote }}
@@ -32,6 +37,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -47,7 +57,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.confluenceMcp | toYaml | sha256sum }}
     spec:
       {{- if .Values.mcpAddons.confluenceMcp.nodeSelector }}
@@ -157,6 +171,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-confluence-mcp
diff --git a/helm/holmes/templates/mcp-servers/confluence-mcp/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/confluence-mcp/networkpolicy.yaml
index e8ae5922f2..9e16846055 100644
--- a/helm/holmes/templates/mcp-servers/confluence-mcp/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/confluence-mcp/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/gcp/deployment.yaml b/helm/holmes/templates/mcp-servers/gcp/deployment.yaml
index 52d0d732b3..2344de3b4d 100644
--- a/helm/holmes/templates/mcp-servers/gcp/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/gcp/deployment.yaml
@@ -12,6 +12,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   {{- if .Values.mcpAddons.gcp.config.project }}
   GCP_PROJECT: {{ .Values.mcpAddons.gcp.config.project | quote }}
@@ -39,9 +44,17 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
-  {{- if .Values.mcpAddons.gcp.serviceAccount.annotations }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- $ann := dict -}}
+  {{- with (include "holmes.commonAnnotations" . | fromYaml) -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- with .Values.mcpAddons.gcp.serviceAccount.annotations -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- if $ann }}
   annotations:
-    {{- toYaml .Values.mcpAddons.gcp.serviceAccount.annotations | nindent 4 }}
+    {{- toYaml $ann | nindent 4 }}
   {{- end }}
 {{- end }}
 ---
@@ -56,6 +69,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -71,7 +89,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.gcp | toYaml | sha256sum }}
     spec:
       serviceAccountName: {{ .Values.mcpAddons.gcp.serviceAccount.name }}
@@ -352,6 +374,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-gcp-mcp
diff --git a/helm/holmes/templates/mcp-servers/gcp/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/gcp/networkpolicy.yaml
index c481a88639..da451812d0 100644
--- a/helm/holmes/templates/mcp-servers/gcp/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/gcp/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/github/deployment.yaml b/helm/holmes/templates/mcp-servers/github/deployment.yaml
index a90ff99c43..06bbe2446a 100644
--- a/helm/holmes/templates/mcp-servers/github/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/github/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   {{- if .Values.mcpAddons.github.config.toolsets }}
   GITHUB_TOOLSETS: {{ .Values.mcpAddons.github.config.toolsets | quote }}
@@ -30,6 +35,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -45,7 +55,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.github | toYaml | sha256sum }}
     spec:
       {{- if .Values.mcpAddons.github.nodeSelector }}
@@ -170,6 +184,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-github-mcp
diff --git a/helm/holmes/templates/mcp-servers/github/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/github/networkpolicy.yaml
index c71ef4eb02..02efd0592e 100644
--- a/helm/holmes/templates/mcp-servers/github/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/github/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/kubernetes-remediation/deployment.yaml b/helm/holmes/templates/mcp-servers/kubernetes-remediation/deployment.yaml
index 277750c178..9cb71d1277 100644
--- a/helm/holmes/templates/mcp-servers/kubernetes-remediation/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/kubernetes-remediation/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   KUBECTL_ALLOWED_COMMANDS: {{ .Values.mcpAddons.kubernetesRemediation.config.allowedCommands | quote }}
   KUBECTL_DANGEROUS_FLAGS: {{ .Values.mcpAddons.kubernetesRemediation.config.dangerousFlags | quote }}
@@ -31,6 +36,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -46,7 +56,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.kubernetesRemediation | toYaml | sha256sum }}
     spec:
       {{- if .Values.mcpAddons.kubernetesRemediation.serviceAccount.create }}
@@ -132,6 +146,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-k8s-remediation-mcp
@@ -155,9 +174,17 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
-  {{- with .Values.mcpAddons.kubernetesRemediation.serviceAccount.annotations }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- $ann := dict -}}
+  {{- with (include "holmes.commonAnnotations" . | fromYaml) -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- with .Values.mcpAddons.kubernetesRemediation.serviceAccount.annotations -}}
+  {{- $ann = mergeOverwrite $ann . -}}
+  {{- end -}}
+  {{- if $ann }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- toYaml $ann | nindent 4 }}
   {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -170,6 +197,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/helm/holmes/templates/mcp-servers/kubernetes-remediation/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/kubernetes-remediation/networkpolicy.yaml
index 75b1dab29d..4674ee5ddd 100644
--- a/helm/holmes/templates/mcp-servers/kubernetes-remediation/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/kubernetes-remediation/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/mariadb/deployment.yaml b/helm/holmes/templates/mcp-servers/mariadb/deployment.yaml
index d3a27e7c52..f2b936fd1c 100644
--- a/helm/holmes/templates/mcp-servers/mariadb/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/mariadb/deployment.yaml
@@ -12,6 +12,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 type: Opaque
 data:
   username: {{ .Values.mcpAddons.mariadb.config.username | b64enc }}
@@ -29,6 +34,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -44,7 +54,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.mariadb | toYaml | sha256sum }}
         {{- if .Values.mcpAddons.mariadb.annotations }}
         {{- toYaml .Values.mcpAddons.mariadb.annotations | nindent 8 }}
@@ -137,6 +151,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   type: ClusterIP
   selector:
diff --git a/helm/holmes/templates/mcp-servers/mariadb/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/mariadb/networkpolicy.yaml
index ca0dede60a..c9c69b1407 100644
--- a/helm/holmes/templates/mcp-servers/mariadb/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/mariadb/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/prefect/deployment.yaml b/helm/holmes/templates/mcp-servers/prefect/deployment.yaml
index e8ccc47c0c..24b7806c71 100644
--- a/helm/holmes/templates/mcp-servers/prefect/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/prefect/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   PREFECT_API_URL: {{ required "mcpAddons.prefect.config.apiUrl is required" .Values.mcpAddons.prefect.config.apiUrl | quote }}
 ---
@@ -25,6 +30,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -40,7 +50,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.prefect | toYaml | sha256sum }}
     spec:
       {{- if .Values.mcpAddons.prefect.nodeSelector }}
@@ -100,6 +114,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-prefect-mcp
diff --git a/helm/holmes/templates/mcp-servers/prefect/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/prefect/networkpolicy.yaml
index 9c108e56f8..5d22a040ff 100644
--- a/helm/holmes/templates/mcp-servers/prefect/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/prefect/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/mcp-servers/sentry/deployment.yaml b/helm/holmes/templates/mcp-servers/sentry/deployment.yaml
index 0d28500439..b5512d3823 100644
--- a/helm/holmes/templates/mcp-servers/sentry/deployment.yaml
+++ b/helm/holmes/templates/mcp-servers/sentry/deployment.yaml
@@ -11,6 +11,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data: {}
 ---
 apiVersion: apps/v1
@@ -24,6 +29,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -39,7 +49,11 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: mcp-server
         app.kubernetes.io/part-of: holmes
+        {{- include "holmes.commonLabels" . | nindent 8 }}
       annotations:
+        {{- with (include "holmes.commonAnnotations" .) }}
+        {{- . | nindent 8 }}
+        {{- end }}
         checksum/config: {{ .Values.mcpAddons.sentry | toYaml | sha256sum }}
     spec:
       {{- if .Values.mcpAddons.sentry.nodeSelector }}
@@ -96,6 +110,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   selector:
     app: {{ .Release.Name }}-sentry-mcp
diff --git a/helm/holmes/templates/mcp-servers/sentry/networkpolicy.yaml b/helm/holmes/templates/mcp-servers/sentry/networkpolicy.yaml
index 6911ca44c0..46930d4309 100644
--- a/helm/holmes/templates/mcp-servers/sentry/networkpolicy.yaml
+++ b/helm/holmes/templates/mcp-servers/sentry/networkpolicy.yaml
@@ -10,6 +10,11 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: mcp-server
     app.kubernetes.io/part-of: holmes
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   podSelector:
     matchLabels:
diff --git a/helm/holmes/templates/operator-deployment.yaml b/helm/holmes/templates/operator-deployment.yaml
index 3aa897716d..8091ecec67 100644
--- a/helm/holmes/templates/operator-deployment.yaml
+++ b/helm/holmes/templates/operator-deployment.yaml
@@ -9,6 +9,11 @@ metadata:
     app.kubernetes.io/name: holmes-operator
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: 1
   selector:
@@ -22,6 +27,11 @@ spec:
         app: holmes-operator
         app.kubernetes.io/name: holmes-operator
         app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- include "holmes.commonLabels" . | nindent 8 }}
+      {{- with (include "holmes.commonAnnotations" .) }}
+      annotations:
+        {{- . | nindent 8 }}
+      {{- end }}
     spec:
       serviceAccountName: {{ .Release.Name }}-operator
       securityContext:
diff --git a/helm/holmes/templates/operator-rbac.yaml b/helm/holmes/templates/operator-rbac.yaml
index 7261843829..4660114804 100644
--- a/helm/holmes/templates/operator-rbac.yaml
+++ b/helm/holmes/templates/operator-rbac.yaml
@@ -9,6 +9,11 @@ metadata:
     app.kubernetes.io/name: holmes-operator
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -19,6 +24,11 @@ metadata:
     app.kubernetes.io/name: holmes-operator
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 rules:
 # HealthCheck CRD permissions
 - apiGroups: ["holmesgpt.dev"]
@@ -63,6 +73,11 @@ metadata:
     app.kubernetes.io/name: holmes-operator
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "holmes.commonLabels" . | nindent 4 }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/helm/holmes/templates/toolset-config.yaml b/helm/holmes/templates/toolset-config.yaml
index 4617367c36..bae3852d38 100644
--- a/helm/holmes/templates/toolset-config.yaml
+++ b/helm/holmes/templates/toolset-config.yaml
@@ -4,6 +4,14 @@ kind: ConfigMap
 metadata:
   name: custom-toolsets-configmap
   namespace: {{ .Release.Namespace }}
+  {{- with (include "holmes.commonLabels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "holmes.commonAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   custom_toolset.yaml: |-
     {{- $toolsets := .Values.toolsets }}
diff --git a/helm/holmes/values.yaml b/helm/holmes/values.yaml
index d0c80d8ef0..0df0d2216a 100644
--- a/helm/holmes/values.yaml
+++ b/helm/holmes/values.yaml
@@ -5,6 +5,8 @@ additionalEnvVars: []
 additional_env_vars: []
 imagePullSecrets: []
 podAnnotations: {}
+commonLabels: {}
+commonAnnotations: {}
 
 replicas: 1
 imagePullPolicy: IfNotPresent