diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 1be4a8a..9baa738 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -11,6 +11,9 @@ on:
 jobs:
   helm-lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -20,11 +23,22 @@ jobs:
         with:
           version: v4.1.4
 
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
+
       - name: Lint common chart
         run: helm lint charts/common
 
+      - name: Lint api chart
+        run: |
+          helm dependency update charts/api
+          helm lint charts/api
+
   template-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -34,14 +48,28 @@ jobs:
         with:
           version: v4.1.4
 
-      - name: Build dependencies
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
+
+      - name: Build dependencies (common)
         run: helm dependency update ci/common/
 
-      - name: Template with defaults
+      - name: Build dependencies (api)
+        run: |
+          helm dependency update charts/api
+          helm dependency update ci/api/
+
+      - name: Template common with defaults
         run: helm template test ci/common/
 
-      - name: Template with overrides
+      - name: Template common with overrides
         run: helm template test ci/common/ --set fullnameOverride=override-test --set global.imageRegistry=test.io
 
-      - name: Template with storage class
+      - name: Template common with storage class
         run: helm template test ci/common/ --set global.storageClass=fast-ssd
+
+      - name: Template api with defaults
+        run: helm template test ci/api/
+
+      - name: Template api with overrides
+        run: helm template test ci/api/ --set api.fullnameOverride=override-test --set api.image.tag=latest
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index f2cba6c..4b827df 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -11,14 +11,14 @@ concurrency:
 
 jobs:
   release-please:
-    if: github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
     outputs:
-      release_created: ${{ steps.rp.outputs['charts/common--release_created'] }}
-      tag_name: ${{ steps.rp.outputs['charts/common--tag_name'] }}
+      releases_created: ${{ steps.rp.outputs.releases_created }}
+      paths_released: ${{ steps.rp.outputs.paths_released }}
     steps:
       - name: Run release-please
         id: rp
@@ -29,7 +29,7 @@ jobs:
 
   publish:
     needs: release-please
-    if: needs.release-please.outputs.release_created == 'true'
+    if: needs.release-please.outputs.releases_created == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -39,32 +39,26 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          ref: ${{ needs.release-please.outputs.tag_name }}
+          ref: ${{ github.event.workflow_run.head_sha }}
 
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
         with:
           version: v4.1.4
 
-      - name: Validate version matches tag
-        run: |
-          CHART_VERSION=$(grep '^version:' charts/common/Chart.yaml | awk '{print $2}')
-          TAG_VERSION="${{ needs.release-please.outputs.tag_name }}"
-          TAG_VERSION="${TAG_VERSION#common-v}"
-          if [ "$CHART_VERSION" != "$TAG_VERSION" ]; then
-            echo "ERROR: Chart.yaml version ($CHART_VERSION) does not match tag ($TAG_VERSION)"
-            exit 1
-          fi
-          echo "Version match confirmed: $CHART_VERSION"
-
       - name: Login to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
 
-      - name: Package chart
-        run: helm package charts/common
-
-      - name: Push to GHCR
-        run: helm push common-*.tgz oci://ghcr.io/docspec
+      - name: Package and push released charts
+        run: |
+          PATHS_RELEASED='${{ needs.release-please.outputs.paths_released }}'
+          for chart_path in $(echo "$PATHS_RELEASED" | jq -r '.[]'); do
+            chart_name="$(basename "$chart_path")"
+            echo "Publishing $chart_name from $chart_path"
+            helm dependency update "$chart_path"
+            helm package "$chart_path" --destination .
+            helm push ${chart_name}-*.tgz oci://ghcr.io/docspec
+          done
 
       - name: Logout from GHCR
         if: always()
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 3de272b..0503c9a 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -31,6 +31,9 @@ jobs:
 
   template-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -40,14 +43,28 @@ jobs:
         with:
           version: v4.1.4
 
-      - name: Build dependencies
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
+
+      - name: Build dependencies (common)
         run: helm dependency update ci/common/
 
-      - name: Template with defaults
+      - name: Build dependencies (api)
+        run: |
+          helm dependency update charts/api
+          helm dependency update ci/api/
+
+      - name: Template common with defaults
         run: helm template test ci/common/
 
-      - name: Template with overrides
+      - name: Template common with overrides
         run: helm template test ci/common/ --set fullnameOverride=override-test --set global.imageRegistry=test.io
 
-      - name: Template with storage class
+      - name: Template common with storage class
         run: helm template test ci/common/ --set global.storageClass=fast-ssd
+
+      - name: Template api with defaults
+        run: helm template test ci/api/
+
+      - name: Template api with overrides
+        run: helm template test ci/api/ --set api.fullnameOverride=override-test --set api.image.tag=latest
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index b58b091..b68e265 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,4 @@
 {
-  "charts/common": "0.1.0"
+  "charts/common": "0.1.0",
+  "charts/api": "0.0.1"
 }
diff --git a/charts/api/Chart.lock b/charts/api/Chart.lock
new file mode 100644
index 0000000..5ebd5f4
--- /dev/null
+++ b/charts/api/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: oci://ghcr.io/docspec
+  version: 0.1.0
+digest: sha256:95ae0fb91e1fdf11ebef816ec098a87711783f18b9a65f43e7cbb2c44e609ee2
+generated: "2026-04-28T15:17:40.367790072+02:00"
diff --git a/charts/api/Chart.yaml b/charts/api/Chart.yaml
new file mode 100644
index 0000000..efea3cb
--- /dev/null
+++ b/charts/api/Chart.yaml
@@ -0,0 +1,20 @@
+apiVersion: v2
+name: api
+description: Helm chart for the docspec document conversion API
+type: application
+version: 0.0.1
+kubeVersion: ">=1.28.0"
+home: https://github.com/docspec/charts
+sources:
+  - https://github.com/docspec/charts
+  - https://github.com/docspecio/api
+maintainers:
+  - name: docspec
+keywords:
+  - docspec
+  - document-conversion
+  - api
+dependencies:
+  - name: common
+    version: "0.x.x"
+    repository: "oci://ghcr.io/docspec"
diff --git a/charts/api/templates/NOTES.txt b/charts/api/templates/NOTES.txt
new file mode 100644
index 0000000..110a868
--- /dev/null
+++ b/charts/api/templates/NOTES.txt
@@ -0,0 +1,18 @@
+{{- $localPort := .Values.service.port -}}
+docspec API is now installed.
+
+Get the API URL:
+{{- if .Values.ingress.enabled }}
+  http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.ingress.hostname }}/conversion
+{{- else }}
+  kubectl port-forward svc/{{ include "api.names.fullname" . }} {{ $localPort }}:{{ .Values.service.port }} -n {{ include "api.names.namespace" . }}
+  Then: http://localhost:{{ $localPort }}/conversion
+{{- end }}
+
+Health check:
+  curl http://localhost:{{ $localPort }}/health
+
+Convert a document:
+  curl -X POST http://localhost:{{ $localPort }}/conversion \
+    -H "Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document" \
+    --data-binary @document.docx
diff --git a/charts/api/templates/_helpers.tpl b/charts/api/templates/_helpers.tpl
new file mode 100644
index 0000000..e04883d
--- /dev/null
+++ b/charts/api/templates/_helpers.tpl
@@ -0,0 +1,57 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "api.names.name" -}}
+{{- include "common.names.name" . -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "api.names.fullname" -}}
+{{- include "common.names.fullname" . -}}
+{{- end -}}
+
+{{/*
+Allow the release namespace to be overridden.
+*/}}
+{{- define "api.names.namespace" -}}
+{{- include "common.names.namespace" . -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "api.names.chart" -}}
+{{- include "common.names.chart" . -}}
+{{- end -}}
+
+{{/*
+Kubernetes standard labels.
+*/}}
+{{- define "api.labels.standard" -}}
+{{- include "common.labels.standard" . -}}
+{{- end -}}
+
+{{/*
+Labels used on selector.matchLabels and Service spec.selector.
+*/}}
+{{- define "api.labels.matchLabels" -}}
+{{- include "common.labels.matchLabels" . -}}
+{{- end -}}
+
+{{/*
+Return the proper image name.
+Usage: {{ include "api.image" . }}
+*/}}
+{{- define "api.image" -}}
+{{- include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) -}}
+{{- end -}}
+
+{{/*
+Return the ServiceAccount name to use.
+Usage: {{ include "api.serviceAccountName" . }}
+*/}}
+{{- define "api.serviceAccountName" -}}
+{{- include "common.rbac.serviceAccountName" (dict "serviceAccount" .Values.serviceAccount "context" $) -}}
+{{- end -}}
diff --git a/charts/api/templates/deployment.yaml b/charts/api/templates/deployment.yaml
new file mode 100644
index 0000000..c54ec35
--- /dev/null
+++ b/charts/api/templates/deployment.yaml
@@ -0,0 +1,62 @@
+{{- $fullName := include "api.names.fullname" . -}}
+apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels: {{- include "api.labels.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels: {{- include "api.labels.matchLabels" . | nindent 8 }}
+        {{- if .Values.podLabels }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.podLabels "context" $) | nindent 8 }}
+        {{- end }}
+      {{- if .Values.podAnnotations }}
+      annotations: {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "api.serviceAccountName" . }}
+      {{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image) "context" $) | nindent 6 }}
+      securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.extraVolumes }}
+      volumes: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: api
+          image: {{ include "api.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext: {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.containerPorts.http }}
+              protocol: TCP
+          env:
+            - name: PORT
+              value: {{ .Values.containerPorts.http | quote }}
+            {{- with .Values.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources: {{- include "common.resources.preset.apply" (dict "type" .Values.resourcesPreset "resources" .Values.resources) | nindent 12 }}
+          livenessProbe: {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe: {{- toYaml .Values.readinessProbe | nindent 12 }}
+          {{- with .Values.extraVolumeMounts }}
+          volumeMounts: {{- toYaml . | nindent 12 }}
+          {{- end }}
diff --git a/charts/api/templates/hpa.yaml b/charts/api/templates/hpa.yaml
new file mode 100644
index 0000000..3ce28b7
--- /dev/null
+++ b/charts/api/templates/hpa.yaml
@@ -0,0 +1,32 @@
+{{- if .Values.autoscaling.enabled -}}
+apiVersion: {{ include "common.capabilities.hpa.apiVersion" . }}
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "api.names.fullname" . }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+    kind: Deployment
+    name: {{ include "api.names.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}
diff --git a/charts/api/templates/ingress.yaml b/charts/api/templates/ingress.yaml
new file mode 100644
index 0000000..c95afd9
--- /dev/null
+++ b/charts/api/templates/ingress.yaml
@@ -0,0 +1,30 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: {{ include "common.ingress.apiVersion" . }}
+kind: Ingress
+metadata:
+  name: {{ include "api.names.fullname" . }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+  {{- if .Values.ingress.annotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.ingress.annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (include "common.ingress.supportsIngressClassname" .) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.hostname }}
+      secretName: {{ printf "%s-tls" (include "api.names.fullname" .) }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.hostname }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.path }}
+            {{- if include "common.ingress.supportsPathType" . }}
+            pathType: {{ .Values.ingress.pathType }}
+            {{- end }}
+            backend: {{- include "common.ingress.backend" (dict "serviceName" (include "api.names.fullname" .) "servicePort" "http") | nindent 14 }}
+{{- end }}
diff --git a/charts/api/templates/networkpolicy.yaml b/charts/api/templates/networkpolicy.yaml
new file mode 100644
index 0000000..d430b4d
--- /dev/null
+++ b/charts/api/templates/networkpolicy.yaml
@@ -0,0 +1,58 @@
+{{- if .Values.networkPolicy.enabled -}}
+apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
+kind: NetworkPolicy
+metadata:
+  name: {{ include "api.names.fullname" . }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  podSelector:
+    matchLabels: {{- include "api.labels.matchLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    {{- if .Values.networkPolicy.allowExternalEgress }}
+    - {}
+    {{- else }}
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    {{- if .Values.networkPolicy.extraEgress }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.extraEgress "context" $) | nindent 4 }}
+    {{- end }}
+    {{- end }}
+  ingress:
+    - ports:
+        - port: {{ .Values.containerPorts.http }}
+      {{- if not .Values.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels: {{- include "api.labels.matchLabels" . | nindent 14 }}
+        - podSelector:
+            matchLabels:
+              {{ include "api.names.fullname" . }}-client: "true"
+        {{- if .Values.networkPolicy.ingressNSMatchLabels }}
+        - namespaceSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
+          podSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- if .Values.networkPolicy.extraIngress }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.extraIngress "context" $) | nindent 4 }}
+    {{- end }}
+{{- end }}
diff --git a/charts/api/templates/pdb.yaml b/charts/api/templates/pdb.yaml
new file mode 100644
index 0000000..21d0dc3
--- /dev/null
+++ b/charts/api/templates/pdb.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.podDisruptionBudget.enabled -}}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "api.names.fullname" . }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- end }}
+  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels: {{- include "api.labels.matchLabels" . | nindent 6 }}
+{{- end }}
diff --git a/charts/api/templates/service.yaml b/charts/api/templates/service.yaml
new file mode 100644
index 0000000..a65c89b
--- /dev/null
+++ b/charts/api/templates/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "api.names.fullname" . }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector: {{- include "api.labels.matchLabels" . | nindent 4 }}
diff --git a/charts/api/templates/serviceaccount.yaml b/charts/api/templates/serviceaccount.yaml
new file mode 100644
index 0000000..8f5bb95
--- /dev/null
+++ b/charts/api/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "api.serviceAccountName" . }}
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+  {{- if .Values.serviceAccount.annotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end }}
diff --git a/charts/api/values.yaml b/charts/api/values.yaml
new file mode 100644
index 0000000..9d5160e
--- /dev/null
+++ b/charts/api/values.yaml
@@ -0,0 +1,111 @@
+global:
+  imageRegistry: ""
+  imagePullSecrets: []
+  storageClass: ""
+
+replicaCount: 1
+
+image:
+  registry: ghcr.io
+  repository: docspecio/api
+  tag: "3.0.1"
+  digest: ""
+  pullPolicy: IfNotPresent
+  pullSecrets: []
+
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  create: true
+  name: ""
+  annotations: {}
+  automountServiceAccountToken: false
+
+podAnnotations: {}
+podLabels: {}
+commonLabels: {}
+commonAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop:
+      - ALL
+
+containerPorts:
+  http: 4000
+
+service:
+  type: ClusterIP
+  port: 4000
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hostname: api.docspec.local
+  path: /
+  pathType: Prefix
+  tls: false
+
+# Resource preset from common chart: nano/micro/small/medium/large/xlarge/2xlarge
+# When autoscaling is enabled, resource requests MUST be set for HPA to function
+resourcesPreset: "small"
+resources: {}
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: ""
+
+podDisruptionBudget:
+  enabled: true
+  minAvailable: ""
+  maxUnavailable: 1
+
+networkPolicy:
+  enabled: true
+  allowExternal: true
+  allowExternalEgress: false
+  extraIngress: []
+  extraEgress: []
+  ingressNSMatchLabels: {}
+  ingressNSPodMatchLabels: {}
+
+livenessProbe:
+  httpGet:
+    path: /health
+    port: http
+  initialDelaySeconds: 10
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /health
+    port: http
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+extraEnvVars: []
+extraVolumes: []
+extraVolumeMounts: []
diff --git a/ci/api/Chart.yaml b/ci/api/Chart.yaml
new file mode 100644
index 0000000..bb26afa
--- /dev/null
+++ b/ci/api/Chart.yaml
@@ -0,0 +1,9 @@
+apiVersion: v2
+name: api-test
+description: CI test chart for docspec/api
+version: 0.0.1
+type: application
+dependencies:
+  - name: api
+    version: "*"
+    repository: "file://../../charts/api"
diff --git a/ci/api/templates/test-render.yaml b/ci/api/templates/test-render.yaml
new file mode 100644
index 0000000..7145bed
--- /dev/null
+++ b/ci/api/templates/test-render.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "api.names.fullname" . }}-test
+  namespace: {{ include "api.names.namespace" . }}
+  labels: {{- include "api.labels.standard" . | nindent 4 }}
+data:
+  fullname: {{ include "api.names.fullname" . }}
+  name: {{ include "api.names.name" . }}
+  chart: {{ include "api.names.chart" . }}
+  image: {{ include "api.image" . }}
+  serviceAccountName: {{ include "api.serviceAccountName" . }}
+  matchLabels: |
+    {{- include "api.labels.matchLabels" . | nindent 4 }}
diff --git a/ci/api/values.yaml b/ci/api/values.yaml
new file mode 100644
index 0000000..610de47
--- /dev/null
+++ b/ci/api/values.yaml
@@ -0,0 +1,55 @@
+## Top-level values for parent-chart test template (test-render.yaml calls
+## api.image / api.serviceAccountName with the parent's context).
+image:
+  registry: ghcr.io
+  repository: docspecio/api
+  tag: "3.0.1"
+
+serviceAccount:
+  create: true
+  name: ""
+
+global:
+  imageRegistry: ""
+  imagePullSecrets: []
+
+## Subchart values — Helm scopes these into the api subchart's context.
+api:
+  replicaCount: 1
+
+  image:
+    registry: ghcr.io
+    repository: docspecio/api
+    tag: "3.0.1"
+
+  serviceAccount:
+    create: true
+
+  ingress:
+    enabled: true
+    hostname: test.docspec.local
+    path: /
+    pathType: Prefix
+
+  autoscaling:
+    enabled: false
+
+  resourcesPreset: "micro"
+  resources: {}
+
+  extraEnvVars:
+    - name: TEST_VAR
+      value: "test"
+
+  containerPorts:
+    http: 4000
+
+  podDisruptionBudget:
+    enabled: true
+    minAvailable: 1
+    maxUnavailable: ""
+
+  networkPolicy:
+    enabled: true
+    allowExternal: true
+    allowExternalEgress: false
diff --git a/release-please-config.json b/release-please-config.json
index 5417cba..e53e72a 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -8,6 +8,11 @@
       "release-type": "helm",
       "component": "common",
       "changelog-path": "CHANGELOG.md"
+    },
+    "charts/api": {
+      "release-type": "helm",
+      "component": "api",
+      "changelog-path": "CHANGELOG.md"
     }
   }
 }