diff --git a/Chart.yaml b/Chart.yaml
index e31da99..3279928 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: nofire-edge
 description: A Helm chart for Kubernetes Resource Graph & Causal Analysis
 type: application
-version: 0.5.2
-appVersion: "2.1.0"
+version: 0.6.0
+appVersion: "v3.6.0"
 keywords:
   - kubernetes
   - monitoring
diff --git a/examples/production-values.yaml b/examples/production-values.yaml
index 56033ed..75bdb84 100644
--- a/examples/production-values.yaml
+++ b/examples/production-values.yaml
@@ -2,7 +2,7 @@
 image:
   #repository: localhost:50001/nofire-edge
   repository: nofireai/edge
-  tag: "latest"
+  tag: "v3.6.0"
   pullPolicy: Always
 
 imagePullSecrets: []
diff --git a/manifests.yaml b/manifests.yaml
index c646116..ea1826b 100644
--- a/manifests.yaml
+++ b/manifests.yaml
@@ -19,7 +19,7 @@ spec:
       restartPolicy: Always
       containers:
       - name: client  
-        image: nofireai/edge:latest
+        image: nofireai/edge:v3.6.0
         imagePullPolicy: IfNotPresent
         command: ["/nofire-edge"]
         args: ["--config", "/etc/nofire-edge/config.json"]
diff --git a/templates/configmap.yaml b/templates/configmap.yaml
index 45bd809..be2e70f 100644
--- a/templates/configmap.yaml
+++ b/templates/configmap.yaml
@@ -92,5 +92,25 @@ data:
         "prometheusUrl": {{ .Values.config.netobs.prometheusUrl | default "" | quote }},
         "source": {{ .Values.config.netobs.source | default "" | quote }},
         "prometheusTimeout": {{ .Values.config.netobs.prometheusTimeout | default "10s" | quote }}
+      },
+      "configMapCapture": {
+        "clearText": {{ .Values.config.configMapCapture.clearText | default false }},
+        "captureCap": {{ .Values.config.configMapCapture.captureCap | default 4096 }},
+        "redactKeyPatterns": [
+          {{- range $index, $pattern := .Values.config.configMapCapture.redactKeyPatterns }}
+          {{- if $index }},{{ end }}
+          {{ $pattern | quote }}
+          {{- end }}
+        ]
+      },
+      "envCapture": {
+        "clearText": {{ .Values.config.envCapture.clearText | default false }},
+        "captureCap": {{ .Values.config.envCapture.captureCap | default 4096 }},
+        "redactKeyPatterns": [
+          {{- range $index, $pattern := .Values.config.envCapture.redactKeyPatterns }}
+          {{- if $index }},{{ end }}
+          {{ $pattern | quote }}
+          {{- end }}
+        ]
       }
     }
diff --git a/templates/rbac.yaml b/templates/rbac.yaml
index 90fb326..3c4e7df 100644
--- a/templates/rbac.yaml
+++ b/templates/rbac.yaml
@@ -7,7 +7,7 @@ metadata:
     {{- include "nofire-edge.labels" . | nindent 4 }}
 rules:
 - apiGroups: [""]
-  resources: ["pods", "services", "configmaps", "secrets", "persistentvolumeclaims", "persistentvolumes", "nodes", "namespaces", "resourcequotas", "limitranges"]
+  resources: ["pods", "services", "endpoints", "configmaps", "secrets", "persistentvolumeclaims", "persistentvolumes", "nodes", "namespaces", "resourcequotas", "limitranges"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["apps"]
   resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
diff --git a/values.yaml b/values.yaml
index c761e1f..55681de 100644
--- a/values.yaml
+++ b/values.yaml
@@ -6,8 +6,10 @@
 image:
   repository: nofireai/edge
   pullPolicy: Always
-  # Overrides the image tag whose default is the chart appVersion.
-  tag: "latest"
+  # Overrides the image tag, which otherwise defaults to the chart appVersion.
+  # Released tags carry the "v" prefix (nofireai/edge:v3.6.0) — a bare "3.6.0"
+  # does not exist in the registry.
+  tag: "v3.6.0"
 
 # Image pull secrets
 imagePullSecrets: []
@@ -192,6 +194,7 @@ config:
       - "pods"
       - "nodes"
       - "k8services"
+      - "endpoints"
       - "configmaps"
       - "secrets"
       - "persistentvolumeclaims"
@@ -266,6 +269,33 @@ config:
       url: ""
       interval: "10s"
 
+  # ConfigMap value capture. Hash-by-default so raw customer configuration never
+  # leaves the cluster. Set clearText: true to send values verbatim (still
+  # subject to redactKeyPatterns and captureCap).
+  configMapCapture:
+    # false (default): every ConfigMap value is sent as a sha256 hash.
+    # true: values are sent in the clear, except keys matching redactKeyPatterns.
+    clearText: false
+    # In clear-text mode, ConfigMap data keys matching any of these regexes are
+    # hashed instead of sent verbatim (e.g. secrets embedded in a ConfigMap).
+    redactKeyPatterns: []
+    # - "(?i)(password|passwd|secret|token|apikey|api_key|private_key)"
+    # Per-value byte cap for clear-text values. Values over the cap are trimmed
+    # (Brain is told the value was trimmed). Hashes always cover the full value.
+    captureCap: 4096
+
+  # Container env-var value capture. Hash-by-default so a plaintext credential in
+  # an env var never leaves the cluster. Same model as configMapCapture.
+  envCapture:
+    # false (default): every literal env value is sent as a sha256 hash.
+    # true: literal values are sent in the clear, except names matching redactKeyPatterns.
+    clearText: false
+    # In clear-text mode, env var names matching any of these regexes stay hashed.
+    redactKeyPatterns: []
+    # - "(?i)(password|passwd|secret|token|apikey|api_key|private_key)"
+    # Per-value byte cap for clear-text values (over-cap values trimmed, flagged).
+    captureCap: 4096
+
 # Environment variables
 env: []
 # - name: NODE_NAME