diff --git a/charts/frontend/files/default.conf.template b/charts/frontend/files/default.conf.template
index 853794a..3ead9f9 100644
--- a/charts/frontend/files/default.conf.template
+++ b/charts/frontend/files/default.conf.template
@@ -17,7 +17,7 @@ server {
     # backend Service DNS at request time, so it survives backend pod
     # restarts / re-scheduling in Kubernetes.
     location /api/ {
-        resolver ${NGINX_DNS_RESOLVER} valid=10s;
+        resolver ${NGINX_LOCAL_RESOLVERS} valid=10s;
         set $backend "${BACKEND_URL}";
 
         # Strip the /api prefix before proxying (backend serves at root).
diff --git a/charts/frontend/templates/deployment.yaml b/charts/frontend/templates/deployment.yaml
index b5e6022..6e20d34 100644
--- a/charts/frontend/templates/deployment.yaml
+++ b/charts/frontend/templates/deployment.yaml
@@ -32,8 +32,6 @@ spec:
             # explicit override, otherwise the cluster-internal Service FQDN.
             - name: BACKEND_URL
               value: {{ include "dialog-frontend.backendUrl" . | quote }}
-            - name: NGINX_DNS_RESOLVER
-              value: {{ .Values.env.NGINX_DNS_RESOLVER | quote }}
           volumeMounts:
             # Shadow the image's baked-in template with the ConfigMap so the
             # upstream can change without an image rebuild.
diff --git a/charts/frontend/values.yaml b/charts/frontend/values.yaml
index 0dabc58..3ee8cc5 100644
--- a/charts/frontend/values.yaml
+++ b/charts/frontend/values.yaml
@@ -26,9 +26,6 @@ env:
   # Explicit override for the nginx upstream. Leave empty to auto-build
   # the backend Service FQDN (see dialog-frontend.backendUrl helper).
   BACKEND_URL: ""
-  # nginx DNS resolver used for runtime re-resolution of the backend
-  # Service. Defaults to the Kubernetes cluster DNS service address.
-  NGINX_DNS_RESOLVER: "kube-dns.kube-system.svc.cluster.local"
 
 ingress:
   enabled: false
diff --git a/frontend/default.conf.template b/frontend/default.conf.template
index 853794a..3ead9f9 100644
--- a/frontend/default.conf.template
+++ b/frontend/default.conf.template
@@ -17,7 +17,7 @@ server {
     # backend Service DNS at request time, so it survives backend pod
     # restarts / re-scheduling in Kubernetes.
     location /api/ {
-        resolver ${NGINX_DNS_RESOLVER} valid=10s;
+        resolver ${NGINX_LOCAL_RESOLVERS} valid=10s;
         set $backend "${BACKEND_URL}";
 
         # Strip the /api prefix before proxying (backend serves at root).
diff --git a/values-staging.yaml b/values-staging.yaml
index 03293f5..3f480ee 100644
--- a/values-staging.yaml
+++ b/values-staging.yaml
@@ -59,7 +59,7 @@ llm:
     baseUrl: "https://ollama.com"
   # Create out-of-band, then reference it (keys: ollama-api-key,
   # azure-openai-api-key). Leave empty to let the chart create an empty Secret.
-  existingSecret: dialog-llm
+  existingSecret: llm-credentials
 
 gateway:
   enabled: true