diff --git a/charts/cryptpad/Chart.lock b/charts/cryptpad/Chart.lock
index 1865a6b..bed3629 100644
--- a/charts/cryptpad/Chart.lock
+++ b/charts/cryptpad/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: common
   repository: oci://registry-1.docker.io/bitnamicharts
-  version: 2.31.4
-digest: sha256:2d3ac560b149aaf583ce2c70b6bbd15f35da59a8e5c23d6a240df3534ea5f39b
-generated: "2025-12-15T21:52:37.640097823-03:00"
+  version: 2.39.0
+digest: sha256:3eb3792ee943930941c29d63cd9c9ec07b7ce0da04b23e6b6eb4378a7ea9c0a0
+generated: "2026-05-15T15:55:14.210952212+02:00"
diff --git a/charts/cryptpad/templates/cryptpad.yaml b/charts/cryptpad/templates/cryptpad.yaml
index 8c65b05..e8bc7a2 100644
--- a/charts/cryptpad/templates/cryptpad.yaml
+++ b/charts/cryptpad/templates/cryptpad.yaml
@@ -66,6 +66,9 @@ spec:
               fi
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+        {{- with .Values.extraInitContainers }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -79,6 +82,9 @@ spec:
               value: "{{ include "cryptpad-helm.sandboxDomain" . | trim }}"
             - name: CPAD_CONF
               value: "{{ .Values.cpadConfig }}"
+            {{- with .Values.extraEnv }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
           ports:
             - name: {{ .Values.service.internalPort }}
               containerPort: {{ .Values.service.containerPort }}
@@ -154,6 +160,12 @@ spec:
             - name: configmaps
               mountPath: /cryptpad/customize/application_config.js
               subPath: application_config.js
+            {{- with .Values.extraVolumeMounts }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+        {{- with .Values.extraContainers }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -170,6 +182,9 @@ spec:
         - name: configmaps
           configMap:
             name: {{ include "cryptpad-helm.fullname" . }}
+        {{- with .Values.extraVolumes }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
         {{- if and .Values.persistence.enabled .Values.workloadStateful }}
         {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
         {{- if $dirvalues.existingClaim }}
diff --git a/charts/cryptpad/values.yaml b/charts/cryptpad/values.yaml
index 59e40b2..8918439 100644
--- a/charts/cryptpad/values.yaml
+++ b/charts/cryptpad/values.yaml
@@ -100,6 +100,44 @@ enableEmbedding: false
 # -- Restrict registration to only users with admin keys
 restrictRegistration: false
 
+# -- Additional init containers (e.g. clone a plugin into a shared volume).
+# Rendered into `.spec.template.spec.initContainers` after the built-in init container.
+extraInitContainers: []
+  # - name: install-sso-plugin
+  #   image: alpine/git:2.45.2
+  #   command: ['sh', '-c', 'git clone --depth=1 https://github.com/cryptpad/sso /plugins/sso']
+  #   volumeMounts:
+  #     - name: sso-plugin
+  #       mountPath: /plugins
+
+# -- Additional sidecar containers. Rendered into `.spec.template.spec.containers` after the main container.
+extraContainers: []
+
+# -- Additional volumes for the pod. Rendered into `.spec.template.spec.volumes`.
+extraVolumes: []
+  # - name: sso-plugin
+  #   emptyDir: {}
+  # - name: sso-config
+  #   secret:
+  #     secretName: cryptpad-sso
+
+# -- Additional volume mounts for the main container.
+extraVolumeMounts: []
+  # - name: sso-plugin
+  #   mountPath: /cryptpad/lib/plugins/sso
+  #   subPath: sso
+  # - name: sso-config
+  #   mountPath: /cryptpad/config/sso.js
+  #   subPath: sso.js
+
+# -- Additional environment variables for the main container (raw env entries, supports valueFrom).
+extraEnv: []
+  # - name: OIDC_CLIENT_SECRET
+  #   valueFrom:
+  #     secretKeyRef:
+  #       name: cryptpad-sso
+  #       key: client_secret
+
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""