diff --git a/k8s/prime-rl/templates/deployment.yaml b/k8s/prime-rl/templates/deployment.yaml
index 1ed16b9f5e..fc34fe7d90 100644
--- a/k8s/prime-rl/templates/deployment.yaml
+++ b/k8s/prime-rl/templates/deployment.yaml
@@ -26,6 +26,14 @@ spec:
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.orchestrator.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.orchestrator.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: prime-rl-orchestrator
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -33,7 +41,7 @@ spec:
         {{- if .Values.orchestrator.autoStart }}
         command: ["/bin/bash", "-c"]
         args:
-          - {{ .Values.orchestrator.command }}
+          - {{ .Values.orchestrator.command | quote }}
         {{- else }}
         command: ["sleep", "infinity"]
         {{- end }}
@@ -91,17 +99,30 @@ spec:
         {{- end }}
         resources:
           {{- toYaml .Values.orchestrator.resources | nindent 10 }}
-        {{- if .Values.storage.enabled }}
+        {{- if or .Values.storage.enabled .Values.orchestrator.configMap }}
         volumeMounts:
+        {{- if .Values.storage.enabled }}
         - name: shared-data
           mountPath: {{ .Values.storage.mountPath }}
         {{- end }}
-      {{- if .Values.storage.enabled }}
+        {{- if .Values.orchestrator.configMap }}
+        - name: rl-configs
+          mountPath: /configs
+        {{- end }}
+        {{- end }}
+      {{- if or .Values.storage.enabled .Values.orchestrator.configMap }}
       volumes:
+      {{- if .Values.storage.enabled }}
       - name: shared-data
         persistentVolumeClaim:
           claimName: {{ .Release.Name }}-shared-data
       {{- end }}
+      {{- if .Values.orchestrator.configMap }}
+      - name: rl-configs
+        configMap:
+          name: {{ .Values.orchestrator.configMap }}
+      {{- end }}
+      {{- end }}
 {{- end }}
 ---
 {{- if .Values.inference.enabled }}
@@ -132,6 +153,14 @@ spec:
       {{- if .Values.inference.runtimeClassName }}
       runtimeClassName: {{ .Values.inference.runtimeClassName }}
       {{- end }}
+      {{- with .Values.inference.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.inference.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: prime-rl-inference
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -139,7 +168,7 @@ spec:
         {{- if .Values.inference.autoStart }}
         command: ["/bin/bash", "-c"]
         args:
-          - {{ .Values.inference.command }}
+          - {{ .Values.inference.command | quote }}
         {{- else }}
         command: ["sleep", "infinity"]
         {{- end }}
@@ -261,6 +290,14 @@ spec:
       {{- if .Values.trainer.runtimeClassName }}
       runtimeClassName: {{ .Values.trainer.runtimeClassName }}
       {{- end }}
+      {{- with .Values.trainer.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.trainer.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: prime-rl-trainer
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -268,7 +305,7 @@ spec:
         {{- if .Values.trainer.autoStart }}
         command: ["/bin/bash", "-c"]
         args:
-          - {{ .Values.trainer.command }}
+          - {{ .Values.trainer.command | quote }}
         {{- else }}
         command: ["sleep", "infinity"]
         {{- end }}
diff --git a/k8s/prime-rl/values.yaml b/k8s/prime-rl/values.yaml
index 7fc3b48989..d529863ec3 100644
--- a/k8s/prime-rl/values.yaml
+++ b/k8s/prime-rl/values.yaml
@@ -50,6 +50,19 @@ orchestrator:
   nodeSelector: {}
     # nvidia.com/gpu.present: "true"  # Orchestrator doesn't need GPUs
 
+  tolerations: []
+    # - key: "nvidia.com/gpu"
+    #   operator: "Exists"
+    #   effect: "NoSchedule"
+
+  imagePullSecrets: []
+    # - name: regcred
+
+  # Optional: name of an existing ConfigMap to mount at /configs in the
+  # orchestrator container. Useful for shipping TOML configs without rebuilding
+  # the image. Leave empty to skip.
+  configMap: ""
+
 # Inference component
 inference:
   enabled: true
@@ -75,6 +88,9 @@ inference:
 
   runtimeClassName: nvidia
 
+  tolerations: []
+  imagePullSecrets: []
+
   # Health probes for inference server (/health for startup/readiness, /liveness for engine liveness)
   probes:
     enabled: false
@@ -123,6 +139,9 @@ trainer:
 
   runtimeClassName: nvidia
 
+  tolerations: []
+  imagePullSecrets: []
+
   # Health probes for trainer (requires metrics_server config)
   probes:
     enabled: false