diff --git a/values.yaml b/values.yaml
index 280c7cc..41bcd5a 100644
--- a/values.yaml
+++ b/values.yaml
@@ -6,6 +6,11 @@
 ## here - see `helm show values openbao/openbao` for the full list.
 
 openbao:
+  # Tells the chart's own helpers (BAO_ADDR, health-check scheme, etc.) that
+  # the server listener speaks TLS - avoids duplicate/conflicting env vars.
+  global:
+    tlsDisable: false
+
   server:
     # Standalone mode: single replica, file storage backend, PVC-backed.
     standalone:
@@ -56,13 +61,6 @@ openbao:
         cpu: 500m
         memory: 512Mi
 
-    # The chart hardcodes BAO_ADDR=http://127.0.0.1:8200 for internal CLI
-    # calls (readiness/liveness probes, etc.). Override it now that the
-    # listener speaks TLS, otherwise the pod never becomes Ready.
-    extraEnvironmentVars:
-      BAO_ADDR: https://127.0.0.1:8200
-      BAO_SKIP_VERIFY: "true"
-
   ui:
     enabled: true
     # NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):