diff --git a/deployment/openfilter-pipelines-controller/overrides/development.yaml b/deployment/openfilter-pipelines-controller/overrides/development.yaml
deleted file mode 100644
index 9229c8d..0000000
--- a/deployment/openfilter-pipelines-controller/overrides/development.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-image:
-  repository: plainsightai/openfilter-pipelines-controller
-  tag: "0.5.1"
-
-claimerImage:
-  repository: plainsightai/openfilter-pipelines-claimer
-telemetry:
-  exporterType: otlp
-  # Scheme prefix is load-bearing. openfilter ≥ 0.2.1 infers OTLP gRPC TLS
-  # from the URL scheme — bare host:port silently flips to insecure=False
-  # (TLS), and our in-cluster otel-collector terminates plaintext only, so
-  # every export would fail the handshake with WRONG_VERSION_NUMBER. http://
-  # keeps the inference at insecure=True against this plaintext receiver.
-  exporterOtlpEndpoint: http://otel-collector.monitoring.svc.cluster.local:4317
-# GPU filter pods schedule onto the GKE GPU node pool.
-gpuNodeSelector: "cloud.google.com/gke-gpu-driver-version=latest"
-# Connect to the cluster-managed Valkey instead of the bundled subchart.
-# Precondition: the `openfilter-pipelines-controller` Secret (key
-# VALKEY_PASSWORD) must exist in the release namespace.
-valkey:
-  enabled: false
-  externalValkey:
-    enabled: true
-    host: "valkey-pipelines-controller.openfilter-system.svc.cluster.local"
-    port: 6379
-    password: true
-    existingSecret: "openfilter-pipelines-controller"
-    existingSecretPasswordKey: "VALKEY_PASSWORD"
diff --git a/deployment/openfilter-pipelines-controller/overrides/lab.yaml b/deployment/openfilter-pipelines-controller/overrides/lab.yaml
deleted file mode 100644
index c35eead..0000000
--- a/deployment/openfilter-pipelines-controller/overrides/lab.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-image:
-  repository: plainsightai/openfilter-pipelines-controller
-  tag: "0.5.1"
-
-claimerImage:
-  repository: plainsightai/openfilter-pipelines-claimer
-telemetry:
-  # Lab has no monitoring overlay (no controllers/monitoring/overrides/lab.yaml),
-  # so opt out of the base.yaml OTLP export to avoid filter pods retrying
-  # against a non-resolvable otel-collector service every export interval.
-  # Both fields must be cleared together: the chart gates each env var on its
-  # own non-emptiness, and the controller's validateTelemetryFlags rejects the
-  # half-set state at boot.
-  exporterType: ""
-  exporterOtlpEndpoint: ""
-# Lab environment: k3s cluster with NVIDIA GPU Operator
-gpuNodeSelector: "nvidia.com/gpu.present=true"
-# Connect to the cluster-managed Valkey instead of the bundled subchart.
-# Precondition: the `openfilter-pipelines-controller` Secret (key
-# VALKEY_PASSWORD) must exist in the release namespace.
-valkey:
-  enabled: false
-  externalValkey:
-    enabled: true
-    host: "valkey-pipelines-controller.openfilter-system.svc.cluster.local"
-    port: 6379
-    password: true
-    existingSecret: "openfilter-pipelines-controller"
-    existingSecretPasswordKey: "VALKEY_PASSWORD"
diff --git a/deployment/openfilter-pipelines-controller/overrides/production.yaml b/deployment/openfilter-pipelines-controller/overrides/production.yaml
deleted file mode 100644
index 5a0ebba..0000000
--- a/deployment/openfilter-pipelines-controller/overrides/production.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-image:
-  repository: plainsightai/openfilter-pipelines-controller
-  tag: "0.5.1"
-
-claimerImage:
-  repository: plainsightai/openfilter-pipelines-claimer
-resources:
-  requests:
-    cpu: "100m"
-    memory: "128Mi"
-  limits:
-    cpu: "500m"
-    memory: "512Mi"
-podSecurityContext:
-  runAsNonRoot: true
-  runAsUser: 65534
-  fsGroup: 65534
-securityContext:
-  allowPrivilegeEscalation: false
-  readOnlyRootFilesystem: true
-  capabilities:
-    drop:
-      - ALL
-telemetry:
-  exporterType: otlp
-  # Scheme prefix is load-bearing. openfilter ≥ 0.2.1 infers OTLP gRPC TLS
-  # from the URL scheme — bare host:port silently flips to insecure=False
-  # (TLS), and our in-cluster otel-collector terminates plaintext only, so
-  # every export would fail the handshake with WRONG_VERSION_NUMBER. http://
-  # keeps the inference at insecure=True against this plaintext receiver.
-  exporterOtlpEndpoint: http://otel-collector.monitoring.svc.cluster.local:4317
-# GPU filter pods schedule onto the GKE GPU node pool.
-gpuNodeSelector: "cloud.google.com/gke-gpu-driver-version=latest"
-# Connect to the cluster-managed Valkey instead of the bundled subchart.
-# Precondition: the `openfilter-pipelines-controller` Secret (key
-# VALKEY_PASSWORD) must exist in the release namespace.
-valkey:
-  enabled: false
-  externalValkey:
-    enabled: true
-    host: "valkey-pipelines-controller.openfilter-system.svc.cluster.local"
-    port: 6379
-    password: true
-    existingSecret: "openfilter-pipelines-controller"
-    existingSecretPasswordKey: "VALKEY_PASSWORD"
diff --git a/deployment/openfilter-pipelines-controller/overrides/staging.yaml b/deployment/openfilter-pipelines-controller/overrides/staging.yaml
deleted file mode 100644
index 9229c8d..0000000
--- a/deployment/openfilter-pipelines-controller/overrides/staging.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-image:
-  repository: plainsightai/openfilter-pipelines-controller
-  tag: "0.5.1"
-
-claimerImage:
-  repository: plainsightai/openfilter-pipelines-claimer
-telemetry:
-  exporterType: otlp
-  # Scheme prefix is load-bearing. openfilter ≥ 0.2.1 infers OTLP gRPC TLS
-  # from the URL scheme — bare host:port silently flips to insecure=False
-  # (TLS), and our in-cluster otel-collector terminates plaintext only, so
-  # every export would fail the handshake with WRONG_VERSION_NUMBER. http://
-  # keeps the inference at insecure=True against this plaintext receiver.
-  exporterOtlpEndpoint: http://otel-collector.monitoring.svc.cluster.local:4317
-# GPU filter pods schedule onto the GKE GPU node pool.
-gpuNodeSelector: "cloud.google.com/gke-gpu-driver-version=latest"
-# Connect to the cluster-managed Valkey instead of the bundled subchart.
-# Precondition: the `openfilter-pipelines-controller` Secret (key
-# VALKEY_PASSWORD) must exist in the release namespace.
-valkey:
-  enabled: false
-  externalValkey:
-    enabled: true
-    host: "valkey-pipelines-controller.openfilter-system.svc.cluster.local"
-    port: 6379
-    password: true
-    existingSecret: "openfilter-pipelines-controller"
-    existingSecretPasswordKey: "VALKEY_PASSWORD"