diff --git a/values/clickhouse/env.yaml.gotmpl b/values/clickhouse/env.yaml.gotmpl
index 795af3b4..28e8a72e 100644
--- a/values/clickhouse/env.yaml.gotmpl
+++ b/values/clickhouse/env.yaml.gotmpl
@@ -9,6 +9,11 @@ clickhouse:
   user: default
   credentialsSecret: clickhouse-credentials
   credentialsKey: password
+  # Only used when S3-tiered storage is enabled in cluster.yaml.gotmpl (currently disabled).
+  s3:
+    endpoint: "http://10.255.241.30:30080"
+    bucket: clickhouse
+    secret: clickhouse-s3
   ttl:
     logs: 720h
     traces: 336h
diff --git a/values/clickhouse/values/cluster.yaml.gotmpl b/values/clickhouse/values/cluster.yaml.gotmpl
index d4422775..5894a578 100644
--- a/values/clickhouse/values/cluster.yaml.gotmpl
+++ b/values/clickhouse/values/cluster.yaml.gotmpl
@@ -7,10 +7,42 @@ clickhouse:
   spec:
     shards: 1
     replicas: 1
-    defaultUserPassword:
-      secret:
-        name: {{ .Values.clickhouse.credentialsSecret }}
-        key: {{ .Values.clickhouse.credentialsKey }}
+    settings:
+      defaultUserPassword:
+        secret:
+          name: {{ .Values.clickhouse.credentialsSecret }}
+          key: {{ .Values.clickhouse.credentialsKey }}
+      # S3-tiered storage (hot on local PVC, cold on TOS). Disabled for now — re-enable
+      # together with the containerTemplate.env block below and the s3 block in env.yaml.gotmpl.
+      # extraConfig:
+      #   storage_configuration:
+      #     disks:
+      #       s3:
+      #         type: s3
+      #         endpoint: {{ .Values.clickhouse.s3.endpoint }}/{{ .Values.clickhouse.s3.bucket }}/data/
+      #         use_environment_credentials: true
+      #     policies:
+      #       tiered:
+      #         volumes:
+      #           hot:
+      #             disk: default
+      #           cold:
+      #             disk: s3
+      #         move_factor: 0.2
+      #   merge_tree:
+      #     storage_policy: tiered
+    # containerTemplate:
+    #   env:
+    #     - name: AWS_ACCESS_KEY_ID
+    #       valueFrom:
+    #         secretKeyRef:
+    #           name: {{ .Values.clickhouse.s3.secret }}
+    #           key: AWS_ACCESS_KEY_ID
+    #     - name: AWS_SECRET_ACCESS_KEY
+    #       valueFrom:
+    #         secretKeyRef:
+    #           name: {{ .Values.clickhouse.s3.secret }}
+    #           key: AWS_ACCESS_KEY_SECRET
     dataVolumeClaimSpec:
       accessModes:
         - ReadWriteOnce