diff --git a/.github/workflows/helm-publish.yml b/.github/workflows/helm-publish.yml
index d2ab39b..efd0152 100644
--- a/.github/workflows/helm-publish.yml
+++ b/.github/workflows/helm-publish.yml
@@ -69,6 +69,12 @@ jobs:
       - name: Helm template
         run: helm template ./chart --values ./chart/linter_values.yaml
 
+      - name: Install helm unittest plugin
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest
+
+      - name: Run Helm unit tests
+        run: ./run_tests.sh
+
       - name: Helm template (snapshots)
         run: ./chart/update-snapshots.sh --check-diff-only
 
diff --git a/chart/tests/common/extra_manifest_test.yaml b/chart/tests/common/extra_manifest_test.yaml
new file mode 100644
index 0000000..c117bdc
--- /dev/null
+++ b/chart/tests/common/extra_manifest_test.yaml
@@ -0,0 +1,73 @@
+suite: extraManifests tests
+templates:
+  - templates/extraManifests.yaml
+tests:
+  - it: should render 0 documents when extraManifests is not set
+    set: {}
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render 0 documents when extraManifests is an empty list
+    set:
+      extraManifests: []
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render 0 documents when extraManifests is an empty map
+    set:
+      extraManifests: {}
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render multiple documents when extraManifests is a slice of objects
+    set:
+      extraManifests:
+        - apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: cm-one
+          data:
+            A: "1"
+        - apiVersion: v1
+          kind: Namespace
+          metadata:
+            name: ns-two
+    asserts:
+      - hasDocuments:
+          count: 2
+
+  - it: should render a document when extraManifests contains a string template (tpl evaluated)
+    set:
+      environment: TEST
+      extraManifests:
+        - |
+          apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: "cm-{{ .Values.environment | lower }}"
+          data:
+            ENV: "{{ .Values.environment }}"
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: should render multiple documents when extraManifests is a map (one manifest per key)
+    set:
+      extraManifests:
+        first:
+          apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: ConfigMap-first
+        second:
+          apiVersion: v1
+          kind: ServiceAccount
+          metadata:
+            name: ServiceAccount-second
+    asserts:
+      - hasDocuments:
+          count: 2
+
diff --git a/chart/tests/config/configmap_test.yaml b/chart/tests/config/configmap_test.yaml
new file mode 100644
index 0000000..1d764b7
--- /dev/null
+++ b/chart/tests/config/configmap_test.yaml
@@ -0,0 +1,56 @@
+suite: ConfigMap tests
+templates:
+  - templates/config/configmap.yaml
+tests:
+  - it: should render ConfigMap with correct metadata labels and env data (tpl evaluated)
+    set:
+      environment: TEST
+      ingress:
+        host: myapp.example.com
+      postgresql:
+        auth:
+          database: "my-app"
+      env:
+        ENV_1: VALUE_1
+        # tpl evaluation from values
+        POSTGRES_DB: "{{ .Values.postgresql.auth.database }}"
+        INGRESS_HOST: "{{ .Values.ingress.host }}"
+
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - isAPIVersion:
+          of: v1
+      - isNotEmpty:
+          path: metadata.name
+      - equal:
+          path: metadata.labels.environment
+          value: TEST
+      - equal:
+          path: metadata.labels.release
+          value: RELEASE-NAME
+      - isNotEmpty:
+          path: metadata.labels.app
+      - equal:
+          path: data.ENV_1
+          value: "VALUE_1"
+      - equal:
+          path: data.POSTGRES_DB
+          value: "my-app"
+      - equal:
+          path: data.INGRESS_HOST
+          value: "myapp.example.com"
+
+  - it: should render ConfigMap with empty data when env is empty
+    set:
+      environment: TEST
+      env: {}
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - equal:
+          path: metadata.labels.environment
+          value: TEST
+      - equal:
+          path: data
+          value: null
diff --git a/chart/tests/config/secret_test.yaml b/chart/tests/config/secret_test.yaml
new file mode 100644
index 0000000..bf9240d
--- /dev/null
+++ b/chart/tests/config/secret_test.yaml
@@ -0,0 +1,73 @@
+suite: Config Secret tests
+templates:
+  - templates/config/secret.yaml
+tests:
+  - it: should render Secret with expected metadata and stringData (tpl evaluated)
+    set:
+      environment: TEST
+      secretsStoreCsiDriver:
+        create: false
+      # values used by tpl in secrets
+      postgresql:
+        auth:
+          database: "my-app"
+          postgresPassword: "random-strong-password"
+      secrets:
+        SIMPLE: plain
+        POSTGRES_DB: "{{ .Values.postgresql.auth.database }}"
+        POSTGRES_USER: "postgres"
+        POSTGRES_PASSWORD: "{{ .Values.postgresql.auth.postgresPassword }}"
+
+    asserts:
+      - isKind:
+          of: Secret
+      - isAPIVersion:
+          of: v1
+      - isNotEmpty:
+          path: metadata.name
+      - equal:
+          path: metadata.labels.environment
+          value: TEST
+      - equal:
+          path: metadata.labels.release
+          value: RELEASE-NAME
+      - isNotEmpty:
+          path: metadata.labels.app
+      - equal:
+          path: type
+          value: Opaque
+      - equal:
+          path: stringData.SIMPLE
+          value: "plain"
+      - equal:
+          path: stringData.POSTGRES_DB
+          value: "my-app"
+      - equal:
+          path: stringData.POSTGRES_PASSWORD
+          value: "random-strong-password"
+
+  - it: should not render Secret when secretsStoreCsiDriver.create=true (Azure Key Vault enabled)
+    set:
+      secretsStoreCsiDriver:
+        create: true
+      secrets:
+        SIMPLE: plain
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render Secret with empty stringData when secrets is empty
+    set:
+      environment: TEST
+      secretsStoreCsiDriver:
+        create: false
+      secrets: {}
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.labels.environment
+          value: TEST
+      - equal:
+          path: stringData
+          value: null
diff --git a/run_tests.sh b/run_tests.sh
new file mode 100755
index 0000000..f74fbc3
--- /dev/null
+++ b/run_tests.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+helm unittest chart -f "tests/**/*_test.yaml"