diff --git a/AGENTS.md b/AGENTS.md
index c569063..af2877f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -161,8 +161,7 @@ cd deployment/openfilter-pipelines-controller && helm dependency update
   - `deployment/openfilter-pipelines-controller/`: Main Helm chart
   - `deployment/openfilter-pipelines-controller/crds/`: CRD manifests (synced from config/crd/bases)
   - `deployment/openfilter-pipelines-controller/templates/`: Kubernetes resource templates
-  - `deployment/openfilter-pipelines-controller/overrides/`: Per-environment value overrides (development, lab, staging, production)
-  - `deployment/openfilter-pipelines-controller/values.yaml`: Default configuration values
+  - `deployment/openfilter-pipelines-controller/values.yaml`: Default configuration values (per-environment overrides live in the private `gitops` repo, not here)
 
 - **hack/**: Utility scripts
   - `hack/update-helm-crds.sh`: Script to sync CRDs from config/crd/bases to Helm chart
diff --git a/deployment/openfilter-pipelines-controller/values-production.yaml b/deployment/openfilter-pipelines-controller/values-production.yaml
deleted file mode 100644
index 4f21ec9..0000000
--- a/deployment/openfilter-pipelines-controller/values-production.yaml
+++ /dev/null
@@ -1,95 +0,0 @@
-# Production values for openfilter-pipelines-controller
-# This is a sample configuration for production deployments
-
-# Inject OTel exporter config into every filter container the controller spawns
-# so spans/metrics flow to the in-cluster otel-collector (and from there to
-# Cloud Trace via the googlecloud exporter).
-#
-# Use "otlp" (not "otlp_grpc") here: openfilter's metrics factory
-# (observability/client.py) only matches "otlp" and silently falls through to
-# ConsoleMetricExporter on any other value, while the tracing factory
-# (observability/tracing.py) accepts both — so "otlp" is the only string that
-# wires gRPC for both signals against today's openfilter.
-telemetry:
-  exporterType: "otlp"
-  exporterOtlpEndpoint: "otel-collector.monitoring.svc.cluster.local:4317"
-
-replicaCount: 1
-
-image:
-  repository: plainsightai/openfilter-pipelines-controller
-  pullPolicy: IfNotPresent
-  tag: ""
-
-# Production resource limits
-resources:
-  limits:
-    cpu: 1000m
-    memory: 512Mi
-  requests:
-    cpu: 100m
-    memory: 256Mi
-
-# Enhanced security context
-podSecurityContext:
-  runAsNonRoot: true
-  runAsUser: 65532
-  runAsGroup: 65532
-  fsGroup: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  runAsUser: 65532
-  capabilities:
-    drop:
-    - ALL
-
-# Enable Valkey for production workloads
-valkey:
-  enabled: true
-  architecture: replication
-  auth:
-    enabled: true
-  primary:
-    persistence:
-      enabled: true
-      size: 20Gi
-      storageClass: ""  # Use default storage class
-    resources:
-      limits:
-        cpu: 500m
-        memory: 512Mi
-      requests:
-        cpu: 250m
-        memory: 256Mi
-  replica:
-    replicaCount: 2
-    persistence:
-      enabled: true
-      size: 20Gi
-      storageClass: ""  # Use default storage class
-    resources:
-      limits:
-        cpu: 500m
-        memory: 512Mi
-      requests:
-        cpu: 250m
-        memory: 256Mi
-
-# Production affinity rules for high availability
-affinity:
-  podAntiAffinity:
-    preferredDuringSchedulingIgnoredDuringExecution:
-      - weight: 100
-        podAffinityTerm:
-          labelSelector:
-            matchExpressions:
-              - key: app.kubernetes.io/name
-                operator: In
-                values:
-                  - openfilter-pipelines-controller
-          topologyKey: kubernetes.io/hostname
diff --git a/deployment/openfilter-pipelines-controller/values.yaml b/deployment/openfilter-pipelines-controller/values.yaml
index a369b1d..f77e674 100644
--- a/deployment/openfilter-pipelines-controller/values.yaml
+++ b/deployment/openfilter-pipelines-controller/values.yaml
@@ -136,7 +136,8 @@ volumeMounts: []
 # GPU node selector: comma-separated key=value pairs applied to pods that request
 # nvidia.com/gpu resources (e.g. "cloud.google.com/gke-gpu-driver-version=latest").
 # Leave empty to disable (no node selector is applied). The GKE-specific value is
-# set per environment in overrides/<env>.yaml, so the chart installs cleanly on
+# set per environment in the gitops repo (controllers/openfilter-pipelines-controller/
+# overrides/<env>.yaml), so the chart installs cleanly on
 # non-GKE clusters (kind, minikube, EKS, bare metal) out of the box.
 gpuNodeSelector: ""
 
@@ -200,7 +201,7 @@ args: []
 valkey:
   # Enable the bundled Valkey subchart so the chart self-installs out of the box.
   # Environments that connect to a cluster-managed Valkey flip this to false and
-  # enable externalValkey below — see overrides/<env>.yaml.
+  # enable externalValkey below — see the gitops repo overrides.
   enabled: true
 
   # Valkey architecture (standalone or replication)
@@ -242,7 +243,7 @@ valkey:
   # External Valkey configuration
   # Use this to connect to an existing Valkey instance instead of deploying one.
   # Disabled by default; the cluster-managed host + auth Secret are environment-
-  # specific and live in overrides/<env>.yaml, not in the chart defaults.
+  # specific and live in the gitops repo overrides, not in the chart defaults.
   externalValkey:
     enabled: false
     host: ""