diff --git a/deploy/helm/workflow/templates/deployment.yaml b/deploy/helm/workflow/templates/deployment.yaml
index c6e57d70..406dafd8 100644
--- a/deploy/helm/workflow/templates/deployment.yaml
+++ b/deploy/helm/workflow/templates/deployment.yaml
@@ -8,6 +8,11 @@ spec:
   {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
   {{- end }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
   selector:
     matchLabels:
       {{- include "workflow.selectorLabels" . | nindent 6 }}
@@ -90,7 +95,12 @@ spec:
             {{- end }}
       volumes:
         - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "workflow.fullname" . }}-data
+          {{- else }}
           emptyDir: {}
+          {{- end }}
         {{- if .Values.config.inline }}
         - name: config
           configMap:
diff --git a/deploy/helm/workflow/templates/pvc.yaml b/deploy/helm/workflow/templates/pvc.yaml
new file mode 100644
index 00000000..acd742db
--- /dev/null
+++ b/deploy/helm/workflow/templates/pvc.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "workflow.fullname" . }}-data
+  labels:
+    {{- include "workflow.labels" . | nindent 4 }}
+  annotations:
+    # Keep PVC on helm uninstall to prevent data loss
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}
diff --git a/deploy/helm/workflow/values.yaml b/deploy/helm/workflow/values.yaml
index a09bd700..ce4e7b00 100644
--- a/deploy/helm/workflow/values.yaml
+++ b/deploy/helm/workflow/values.yaml
@@ -93,6 +93,15 @@ env:
 # Sensitive values from Kubernetes secrets
 envFromSecret: ""
 
+# Plugin and runtime data persistence
+# With emptyDir (disabled), data is lost on pod restart — plugins must be re-fetched.
+# Enable to retain downloaded plugins and runtime state across restarts.
+persistence:
+  enabled: false
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 1Gi
+
 # Prometheus monitoring
 monitoring:
   enabled: false