diff --git a/values/clickhouse/env.yaml.gotmpl b/values/clickhouse/env.yaml.gotmpl
index 28e8a72e..361faa45 100644
--- a/values/clickhouse/env.yaml.gotmpl
+++ b/values/clickhouse/env.yaml.gotmpl
@@ -3,8 +3,14 @@ clickhouse:
   autosync: true
   clusterName: clickhouse
   keeperName: clickhouse-keeper
+  # Headless client service the operator creates: <clusterName>-clickhouse-headless
+  serviceName: clickhouse-clickhouse-headless
   storage: 50Gi
   keeperStorage: 5Gi
+  resources:
+    cpuRequest: "2"
+    memoryRequest: 4Gi
+    memoryLimit: 8Gi
   database: otel
   user: default
   credentialsSecret: clickhouse-credentials
diff --git a/values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-grafana-read.yaml b/values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-grafana-read.yaml
index 9a6acaf9..f9fca3ae 100644
--- a/values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-grafana-read.yaml
+++ b/values/clickhouse/manifests/network/CiliumNetworkPolicy-allow-grafana-read.yaml
@@ -18,7 +18,7 @@ spec:
               protocol: TCP
             - port: "8123"
               protocol: TCP
-            - port: "8888"
+            - port: "8080"
               protocol: TCP
             - port: "9363"
               protocol: TCP
diff --git a/values/clickhouse/values/cluster.yaml.gotmpl b/values/clickhouse/values/cluster.yaml.gotmpl
index 5894a578..2a932b95 100644
--- a/values/clickhouse/values/cluster.yaml.gotmpl
+++ b/values/clickhouse/values/cluster.yaml.gotmpl
@@ -31,18 +31,26 @@ clickhouse:
       #         move_factor: 0.2
       #   merge_tree:
       #     storage_policy: tiered
-    # containerTemplate:
-    #   env:
-    #     - name: AWS_ACCESS_KEY_ID
-    #       valueFrom:
-    #         secretKeyRef:
-    #           name: {{ .Values.clickhouse.s3.secret }}
-    #           key: AWS_ACCESS_KEY_ID
-    #     - name: AWS_SECRET_ACCESS_KEY
-    #       valueFrom:
-    #         secretKeyRef:
-    #           name: {{ .Values.clickhouse.s3.secret }}
-    #           key: AWS_ACCESS_KEY_SECRET
+    containerTemplate:
+      # Guarantee CPU via requests; no CPU limit so ClickHouse can burst across cores
+      # (a CPU limit throttles merges/queries).
+      resources:
+        requests:
+          cpu: {{ .Values.clickhouse.resources.cpuRequest }}
+          memory: {{ .Values.clickhouse.resources.memoryRequest }}
+        limits:
+          memory: {{ .Values.clickhouse.resources.memoryLimit }}
+      # env:  # S3 tiering credentials — re-enable with the storage_configuration block above.
+      #   - name: AWS_ACCESS_KEY_ID
+      #     valueFrom:
+      #       secretKeyRef:
+      #         name: {{ .Values.clickhouse.s3.secret }}
+      #         key: AWS_ACCESS_KEY_ID
+      #   - name: AWS_SECRET_ACCESS_KEY
+      #     valueFrom:
+      #       secretKeyRef:
+      #         name: {{ .Values.clickhouse.s3.secret }}
+      #         key: AWS_ACCESS_KEY_SECRET
     dataVolumeClaimSpec:
       accessModes:
         - ReadWriteOnce
diff --git a/values/opentelemetry-collector/values/values.yaml.gotmpl b/values/opentelemetry-collector/values/values.yaml.gotmpl
index 420c5e9c..8fc0800b 100644
--- a/values/opentelemetry-collector/values/values.yaml.gotmpl
+++ b/values/opentelemetry-collector/values/values.yaml.gotmpl
@@ -41,7 +41,7 @@ config:
         insecure: true
     {{- if .Values.clickhouse.enabled }}
     clickhouse:
-      endpoint: tcp://{{ .Values.clickhouse.clusterName }}.clickhouse.svc:9000?dial_timeout=10s
+      endpoint: tcp://{{ .Values.clickhouse.serviceName }}.clickhouse.svc:9000?dial_timeout=10s
       database: {{ .Values.clickhouse.database }}
       username: {{ .Values.clickhouse.user }}
       password: ${env:CH_PASSWORD}
diff --git a/values/prometheus/values/prometheus.yaml.gotmpl b/values/prometheus/values/prometheus.yaml.gotmpl
index f1a36d74..874f5963 100644
--- a/values/prometheus/values/prometheus.yaml.gotmpl
+++ b/values/prometheus/values/prometheus.yaml.gotmpl
@@ -239,7 +239,7 @@ grafana:
     access: proxy
     editable: false
     jsonData:
-      host: {{ .Values.clickhouse.clusterName }}.clickhouse.svc
+      host: {{ .Values.clickhouse.serviceName }}.clickhouse.svc
       port: 9000
       protocol: native
       username: {{ .Values.clickhouse.user }}
@@ -257,7 +257,7 @@ grafana:
     access: proxy
     editable: false
     jsonData:
-      host: {{ .Values.clickhouse.clusterName }}.clickhouse.svc
+      host: {{ .Values.clickhouse.serviceName }}.clickhouse.svc
       port: 9000
       protocol: native
       username: {{ .Values.clickhouse.user }}