diff --git a/.github/workflows/helm-publish.yaml b/.github/workflows/helm-publish.yaml
new file mode 100644
index 0000000..12f4218
--- /dev/null
+++ b/.github/workflows/helm-publish.yaml
@@ -0,0 +1,27 @@
+name: Publish web app serve
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - develop
+
+permissions:
+  contents: read       # checkout — a permissions block zeroes unlisted scopes
+  packages: write      # push image + chart to GHCR
+  pull-requests: read  # helm provenance writer resolves the PR from the commit
+
+jobs:
+  publish_image:
+    name: Publish Docker Image + Helm Chart
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Publish web-app-serve
+        uses: toggle-corp/web-app-serve-action@v0.2.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          helm_publish: true
diff --git a/.github/workflows/publish-web-app-serve.yml b/.github/workflows/publish-web-app-serve.yml
deleted file mode 100644
index 838facd..0000000
--- a/.github/workflows/publish-web-app-serve.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Publish web app serve
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - develop
-
-permissions:
-  packages: write
-
-jobs:
-  publish_image:
-    name: Publish Docker Image
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Publish web-app-serve
-        uses: toggle-corp/web-app-serve-action@v0.1.1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/web-app-serve/helm/.gitignore b/web-app-serve/helm/.gitignore
new file mode 100644
index 0000000..b44294d
--- /dev/null
+++ b/web-app-serve/helm/.gitignore
@@ -0,0 +1,3 @@
+# Artifacts from `helm dependency update` — CI regenerates these; do not commit.
+charts/
+Chart.lock
diff --git a/web-app-serve/helm/Chart.yaml b/web-app-serve/helm/Chart.yaml
new file mode 100644
index 0000000..beca76e
--- /dev/null
+++ b/web-app-serve/helm/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+name: ercs-client-helm
+description: "Wrapper Helm chart for ercs-client, depends on web-app-serve-helm"
+type: application
+version: 0.0.1-SET-BY-CICD          # own semver prefix; CI rewrites only SET-BY-CICD
+dependencies:
+  - name: web-app-serve-helm
+    version: 0.2.1
+    repository: oci://ghcr.io/toggle-corp
+    alias: app
diff --git a/web-app-serve/helm/values.yaml b/web-app-serve/helm/values.yaml
new file mode 100644
index 0000000..a305fec
--- /dev/null
+++ b/web-app-serve/helm/values.yaml
@@ -0,0 +1,7 @@
+app:
+  fullnameOverride: ercs-client
+  image:
+    name: SET-BY-CICD-IMAGE   # CI seds these to the just-built image
+    tag: SET-BY-CICD-TAG
+  ingress:
+    annotations: {}           # pre-seed: the provenance writer FAILS if this parent node is missing