diff --git a/helm/kagent/templates/extra-objects.yaml b/helm/kagent/templates/extra-objects.yaml
new file mode 100644
index 000000000..782ed5485
--- /dev/null
+++ b/helm/kagent/templates/extra-objects.yaml
@@ -0,0 +1,12 @@
+# Render arbitrary user-supplied manifests so resources such as ExternalSecret,
+# HTTPRoute, or NetworkPolicy can be managed within the same chart lifecycle.
+# Each entry is processed through `tpl`, so values may reference the release
+# context (e.g. {{ "{{ include \"kagent.fullname\" . }}" }} or {{ "{{ .Release.Namespace }}" }}).
+{{- range .Values.extraObjects }}
+---
+{{- if typeIs "string" . }}
+{{ tpl . $ }}
+{{- else }}
+{{ tpl (toYaml .) $ }}
+{{- end }}
+{{- end }}
diff --git a/helm/kagent/tests/extra-objects_test.yaml b/helm/kagent/tests/extra-objects_test.yaml
new file mode 100644
index 000000000..552ba97a0
--- /dev/null
+++ b/helm/kagent/tests/extra-objects_test.yaml
@@ -0,0 +1,87 @@
+suite: test extra objects
+templates:
+  - extra-objects.yaml
+tests:
+  - it: should not render anything when extraObjects is empty
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render a map entry as a manifest
+    set:
+      extraObjects:
+        - apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: extra-cm
+          data:
+            foo: bar
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - equal:
+          path: metadata.name
+          value: extra-cm
+      - equal:
+          path: data.foo
+          value: bar
+
+  - it: should render multiple entries as separate documents
+    set:
+      extraObjects:
+        - apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: extra-cm-1
+        - apiVersion: v1
+          kind: Secret
+          metadata:
+            name: extra-secret-1
+    asserts:
+      - hasDocuments:
+          count: 2
+
+  - it: should evaluate tpl expressions against the release context in map entries
+    release:
+      name: my-release
+      namespace: my-namespace
+    set:
+      extraObjects:
+        - apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: '{{ include "kagent.fullname" . }}-extra'
+            namespace: '{{ .Release.Namespace }}'
+    asserts:
+      - equal:
+          path: metadata.name
+          value: my-release-extra
+      - equal:
+          path: metadata.namespace
+          value: my-namespace
+
+  - it: should render and template a multi-line string entry
+    release:
+      name: my-release
+    set:
+      extraObjects:
+        - |
+          apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: {{ include "kagent.fullname" . }}-str
+          data:
+            release: {{ .Release.Name }}
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+      - equal:
+          path: metadata.name
+          value: my-release-str
+      - equal:
+          path: data.release
+          value: my-release
diff --git a/helm/kagent/values.yaml b/helm/kagent/values.yaml
index 5fbe1bd0e..587f344cf 100644
--- a/helm/kagent/values.yaml
+++ b/helm/kagent/values.yaml
@@ -854,3 +854,32 @@ otel:
         endpoint: ""
         timeout: 15000 # milliseconds
         insecure: true
+
+# ==============================================================================
+# EXTRA OBJECTS
+# ==============================================================================
+
+# -- Additional arbitrary Kubernetes manifests to deploy alongside the chart.
+# Each list entry is rendered through `tpl`, so values may reference the release
+# context (e.g. `{{ include "kagent.fullname" . }}`, `{{ .Release.Namespace }}`).
+# Both map and multi-line string entries are supported. Use this to manage
+# resources such as ExternalSecret, HTTPRoute, or NetworkPolicy within the same
+# chart lifecycle without maintaining a separate chart.
+# @default -- []
+extraObjects: []
+  # - apiVersion: external-secrets.io/v1
+  #   kind: ExternalSecret
+  #   metadata:
+  #     name: '{{ include "kagent.fullname" . }}-openai'
+  #     namespace: '{{ .Release.Namespace }}'
+  #   spec:
+  #     secretStoreRef:
+  #       name: aws-secretsmanager
+  #       kind: ClusterSecretStore
+  #     target:
+  #       name: kagent-openai
+  #     data:
+  #       - secretKey: OPENAI_API_KEY
+  #         remoteRef:
+  #           key: prod/kagent/openai
+  #           property: api_key