diff --git a/chart/README.md b/chart/README.md
index c51bd6b..40a83bd 100644
--- a/chart/README.md
+++ b/chart/README.md
@@ -408,6 +408,7 @@ exporter-toolkit is the recommended path on new installs.
 | prometheusServiceMonitor.metricRelabelings | list | `[]` | Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusServiceMonitor.relabelings | list | `[]` | Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusServiceMonitor.scheme | string | `"http"` | Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
+| prometheusServiceMonitor.basicAuth | object | `{}` | BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
 | prometheusServiceMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
 | prometheusPodMonitor.create | bool | `false` | Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users. |
 | prometheusPodMonitor.scrapeInterval | string | `"60s"` | Target scrape interval set in the PodMonitor |
@@ -416,6 +417,7 @@ exporter-toolkit is the recommended path on new installs.
 | prometheusPodMonitor.metricRelabelings | list | `[]` | Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusPodMonitor.relabelings | list | `[]` | Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
 | prometheusPodMonitor.scheme | string | `"http"` | Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
+| prometheusPodMonitor.basicAuth | object | `{}` | BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
 | prometheusPodMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
 | prometheusRules.create | bool | `true` | Should a PrometheusRule object be installed to alert on certificate expiration. For prometheus-operator (kube-prometheus) users. |
 | prometheusRules.rulePrefix | string | `""` | Prefix prepended to the alert rule names of PrometheusRule rules |
@@ -469,7 +471,7 @@ exporter-toolkit is the recommended path on new installs.
 | rbacProxy.tls.existingSecretName | string | `""` | Pre-provisioned Secret carrying `tls.crt` + `tls.key` for the kube-rbac-proxy serving cert. When empty, the chart auto-generates a self-signed cert at install time and reuses it across upgrades via `lookup`. Set this to a cert-manager-managed Secret (or similar) for a cert with a real chain you can rotate independently. |
 | rbacProxy.image.registry | string | `"quay.io"` | kube-rbac-proxy image registry. Empty string opts out of the registry prefix and lets the CRI fall back to its configured default (typically docker.io). |
 | rbacProxy.image.repository | string | `"brancz/kube-rbac-proxy"` | kube-rbac-proxy image repository |
-| rbacProxy.image.tag | string | `"v0.22.0"` | kube-rbac-proxy image tag |
+| rbacProxy.image.tag | string | `"v0.22.1"` | kube-rbac-proxy image tag |
 | rbacProxy.image.digest | string | `""` | kube-rbac-proxy image digest. When set, takes precedence over `tag` (immutable reference) |
 | rbacProxy.image.pullPolicy | string | `"IfNotPresent"` | kube-rbac-proxy image pull policy |
 | rbacProxy.upstreamListenPort | int | `9091` | Listen port for the exporter running inside kube-rbac-proxy exposed Pods |
diff --git a/chart/templates/podmonitor.yaml b/chart/templates/podmonitor.yaml
index 9265d6a..dbbbf91 100644
--- a/chart/templates/podmonitor.yaml
+++ b/chart/templates/podmonitor.yaml
@@ -21,6 +21,10 @@ spec:
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     {{- end }}
     scheme: {{ .Values.prometheusPodMonitor.scheme }}
+    {{- with .Values.prometheusPodMonitor.basicAuth }}
+    basicAuth:
+    {{- . | toYaml | nindent 6 }}
+    {{- end }}
     {{- with .Values.prometheusPodMonitor.tlsConfig }}
     tlsConfig:
     {{- . | toYaml | nindent 6 }}
diff --git a/chart/templates/servicemonitor.yaml b/chart/templates/servicemonitor.yaml
index ef674d2..3b448e3 100644
--- a/chart/templates/servicemonitor.yaml
+++ b/chart/templates/servicemonitor.yaml
@@ -25,6 +25,10 @@ spec:
     bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     {{- end }}
     scheme: {{ .Values.prometheusServiceMonitor.scheme }}
+    {{- with .Values.prometheusServiceMonitor.basicAuth }}
+    basicAuth:
+    {{- . | toYaml | nindent 6 }}
+    {{- end }}
     {{- with .Values.prometheusServiceMonitor.tlsConfig }}
     tlsConfig:
     {{- . | toYaml | nindent 6 }}
diff --git a/chart/values.schema.json b/chart/values.schema.json
index 1b4efc6..d7cfea8 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -84,7 +84,8 @@
             "validating",
             "apiservice",
             "crdConversion"
-          ]
+          ],
+          "type": "object"
         }
       },
       "required": [
@@ -114,29 +115,42 @@
     },
     "extraDeploy": {
       "items": {
-        "required": []
+        "required": [],
+        "type": [
+          "object",
+          "string"
+        ]
       },
       "type": "array"
     },
     "extraDeployVerbatim": {
       "items": {
-        "required": []
+        "required": [],
+        "type": [
+          "object",
+          "string"
+        ]
       },
       "type": "array"
     },
     "extraLabels": {
-      "additionalProperties": true,
-      "required": []
+      "additionalProperties": {
+        "type": "string"
+      },
+      "required": [],
+      "type": "object"
     },
     "extraVolumeMounts": {
       "items": {
-        "required": []
+        "required": [],
+        "type": "object"
       },
       "type": "array"
     },
     "extraVolumes": {
       "items": {
-        "required": []
+        "required": [],
+        "type": "object"
       },
       "type": "array"
     },
@@ -152,16 +166,22 @@
       "additionalProperties": false,
       "properties": {
         "annotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "createDashboard": {
           "default": false,
           "type": "boolean"
         },
         "extraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "sidecarLabel": {
           "default": "grafana_dashboard",
@@ -188,15 +208,22 @@
       "properties": {
         "affinity": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "annotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "daemonSets": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "object"
+          },
+          "required": [],
+          "type": "object"
         },
         "debugMode": {
           "default": false,
@@ -204,19 +231,22 @@
         },
         "env": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "extraVolumeMounts": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "extraVolumes": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
@@ -236,23 +266,34 @@
         },
         "livenessProbe": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "nodeSelector": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "podAnnotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "podExtraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "podSecurityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "priorityClassName": {
           "default": "",
@@ -260,7 +301,8 @@
         },
         "readinessProbe": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "refreshInterval": {
           "default": "300s",
@@ -268,7 +310,8 @@
         },
         "resources": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "restartPolicy": {
           "default": "Always",
@@ -287,7 +330,8 @@
         },
         "securityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "skipSymlinks": {
           "default": false,
@@ -295,35 +339,37 @@
         },
         "tolerations": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "updateStrategy": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "watchDirectories": {
           "items": {
-            "required": []
+            "type": "string"
           },
           "type": "array"
         },
         "watchFiles": {
           "items": {
-            "required": []
+            "type": "string"
           },
           "type": "array"
         },
         "watchKubeconfFiles": {
           "items": {
-            "required": []
+            "type": "string"
           },
           "type": "array"
         },
         "watchSpecificExtensionDirectories": {
           "items": {
-            "required": []
+            "type": "string"
           },
           "type": "array"
         }
@@ -332,15 +378,7 @@
         "debugMode",
         "skipSymlinks",
         "refreshInterval",
-        "tolerations",
-        "priorityClassName",
-        "extraVolumes",
-        "extraVolumeMounts",
-        "watchDirectories",
-        "watchSpecificExtensionDirectories",
-        "watchFiles",
-        "watchKubeconfFiles",
-        "env"
+        "priorityClassName"
       ],
       "type": "object"
     },
@@ -388,7 +426,8 @@
     },
     "imagePullSecrets": {
       "items": {
-        "required": []
+        "required": [],
+        "type": "object"
       },
       "type": "array"
     },
@@ -407,12 +446,18 @@
       "additionalProperties": false,
       "properties": {
         "annotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "extraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "image": {
           "additionalProperties": false,
@@ -453,15 +498,18 @@
         },
         "podSecurityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "resources": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "securityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         }
       },
       "required": [
@@ -478,49 +526,65 @@
       "type": "string"
     },
     "podAnnotations": {
-      "additionalProperties": true,
-      "required": []
+      "additionalProperties": {
+        "type": "string"
+      },
+      "required": [],
+      "type": "object"
     },
     "podExtraLabels": {
-      "additionalProperties": true,
-      "required": []
+      "additionalProperties": {
+        "type": "string"
+      },
+      "required": [],
+      "type": "object"
     },
     "podListenPort": {
-      "default": "9793",
+      "default": 9793,
       "maximum": 65535,
       "minimum": 1,
-      "required": []
+      "type": "integer"
     },
     "priorityClassName": {
       "default": "",
       "type": "string"
     },
     "probeListenPort": {
-      "default": "0",
+      "default": 0,
       "maximum": 65535,
       "minimum": 0,
-      "required": []
+      "type": "integer"
     },
     "prometheusPodMonitor": {
-      "additionalProperties": true,
+      "additionalProperties": false,
       "properties": {
+        "basicAuth": {
+          "additionalProperties": true,
+          "required": [],
+          "type": "object"
+        },
         "create": {
           "default": false,
           "type": "boolean"
         },
         "extraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "metricRelabelings": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "relabelings": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
@@ -542,16 +606,16 @@
         },
         "tlsConfig": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         }
       },
       "required": [
         "create",
         "scrapeInterval",
-        "scrapeTimeout",
-        "metricRelabelings",
-        "relabelings"
-      ]
+        "scrapeTimeout"
+      ],
+      "type": "object"
     },
     "prometheusRules": {
       "additionalProperties": false,
@@ -564,12 +628,18 @@
           "type": "object"
         },
         "alertExtraAnnotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "alertExtraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "alertForOverrides": {
           "additionalProperties": {
@@ -657,9 +727,9 @@
           "type": "boolean"
         },
         "criticalDaysLeft": {
-          "default": "14",
+          "default": 14,
           "minimum": 0,
-          "required": []
+          "type": "integer"
         },
         "crlNeedsRefreshSeverity": {
           "default": "warning",
@@ -680,9 +750,9 @@
           "required": []
         },
         "crlWarningDaysLeft": {
-          "default": "7",
+          "default": 7,
           "minimum": 0,
-          "required": []
+          "type": "integer"
         },
         "disableBuiltinAlertGroup": {
           "default": false,
@@ -690,13 +760,17 @@
         },
         "extraAlertGroups": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "extraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "keystorePassphraseFailuresSeverity": {
           "default": "warning",
@@ -757,9 +831,9 @@
           "required": []
         },
         "warningDaysLeft": {
-          "default": "28",
+          "default": 28,
           "minimum": 0,
-          "required": []
+          "type": "integer"
         }
       },
       "required": [
@@ -772,35 +846,47 @@
         "alertOnCertificateError",
         "alertOnCertificateNotYetValid",
         "alertOnCertificateCollision",
-        "disableBuiltinAlertGroup",
-        "extraAlertGroups"
+        "disableBuiltinAlertGroup"
       ],
       "type": "object"
     },
     "prometheusServiceMonitor": {
-      "additionalProperties": true,
+      "additionalProperties": false,
       "properties": {
+        "basicAuth": {
+          "additionalProperties": true,
+          "required": [],
+          "type": "object"
+        },
         "create": {
           "default": true,
           "type": "boolean"
         },
         "extraAnnotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "extraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "metricRelabelings": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "relabelings": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
@@ -822,16 +908,16 @@
         },
         "tlsConfig": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         }
       },
       "required": [
         "create",
         "scrapeInterval",
-        "scrapeTimeout",
-        "metricRelabelings",
-        "relabelings"
-      ]
+        "scrapeTimeout"
+      ],
+      "type": "object"
     },
     "psp": {
       "additionalProperties": false,
@@ -857,16 +943,25 @@
           "additionalProperties": false,
           "properties": {
             "clusterRoleAnnotations": {
-              "additionalProperties": true,
-              "required": []
+              "additionalProperties": {
+                "type": "string"
+              },
+              "required": [],
+              "type": "object"
             },
             "clusterRoleBindingAnnotations": {
-              "additionalProperties": true,
-              "required": []
+              "additionalProperties": {
+                "type": "string"
+              },
+              "required": [],
+              "type": "object"
             },
             "serviceAccountAnnotations": {
-              "additionalProperties": true,
-              "required": []
+              "additionalProperties": {
+                "type": "string"
+              },
+              "required": [],
+              "type": "object"
             },
             "serviceAccountName": {
               "default": "",
@@ -884,16 +979,25 @@
           "additionalProperties": false,
           "properties": {
             "clusterRoleAnnotations": {
-              "additionalProperties": true,
-              "required": []
+              "additionalProperties": {
+                "type": "string"
+              },
+              "required": [],
+              "type": "object"
             },
             "clusterRoleBindingAnnotations": {
-              "additionalProperties": true,
-              "required": []
+              "additionalProperties": {
+                "type": "string"
+              },
+              "required": [],
+              "type": "object"
             },
             "serviceAccountAnnotations": {
-              "additionalProperties": true,
-              "required": []
+              "additionalProperties": {
+                "type": "string"
+              },
+              "required": [],
+              "type": "object"
             },
             "serviceAccountName": {
               "default": "",
@@ -948,7 +1052,7 @@
               "type": "string"
             },
             "tag": {
-              "default": "v0.22.0",
+              "default": "v0.22.1",
               "type": "string"
             }
           },
@@ -961,11 +1065,13 @@
         },
         "resources": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "securityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "tls": {
           "additionalProperties": false,
@@ -981,10 +1087,10 @@
           "type": "object"
         },
         "upstreamListenPort": {
-          "default": "9091",
+          "default": 9091,
           "maximum": 65535,
           "minimum": 1,
-          "required": []
+          "type": "integer"
         }
       },
       "required": [
@@ -999,11 +1105,15 @@
       "properties": {
         "affinity": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "annotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "cache": {
           "additionalProperties": false,
@@ -1013,9 +1123,9 @@
               "type": "boolean"
             },
             "maxDuration": {
-              "default": "300",
+              "default": 300,
               "minimum": 1,
-              "required": []
+              "type": "integer"
             }
           },
           "required": [
@@ -1025,7 +1135,7 @@
         },
         "configMapKeys": {
           "items": {
-            "required": []
+            "type": "string"
           },
           "type": "array"
         },
@@ -1039,7 +1149,8 @@
         },
         "env": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
@@ -1115,19 +1226,21 @@
         },
         "extraArgs": {
           "items": {
-            "required": []
+            "type": "string"
           },
           "type": "array"
         },
         "extraVolumeMounts": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
         "extraVolumes": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         },
@@ -1185,18 +1298,18 @@
           "additionalProperties": false,
           "properties": {
             "burstQueries": {
-              "default": "10",
+              "default": 10,
               "minimum": 1,
-              "required": []
+              "type": "integer"
             },
             "enabled": {
               "default": false,
               "type": "boolean"
             },
             "queriesPerSecond": {
-              "default": "5",
+              "default": 5,
               "minimum": 0,
-              "required": []
+              "type": "number"
             }
           },
           "required": [
@@ -1205,29 +1318,40 @@
           "type": "object"
         },
         "listPageSize": {
-          "default": "0",
+          "default": 0,
           "minimum": 0,
-          "required": []
+          "type": "integer"
         },
         "livenessProbe": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "nodeSelector": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "podAnnotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "podExtraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "podSecurityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "priorityClassName": {
           "default": "",
@@ -1235,16 +1359,18 @@
         },
         "readinessProbe": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "replicas": {
-          "default": "1",
+          "default": 1,
           "minimum": 1,
-          "required": []
+          "type": "integer"
         },
         "resources": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "restartPolicy": {
           "default": "Always",
@@ -1381,19 +1507,22 @@
             ],
             "type": "object"
           },
-          "required": []
+          "type": "array"
         },
         "securityContext": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "strategy": {
           "additionalProperties": true,
-          "required": []
+          "required": [],
+          "type": "object"
         },
         "tolerations": {
           "items": {
-            "required": []
+            "required": [],
+            "type": "object"
           },
           "type": "array"
         }
@@ -1401,15 +1530,9 @@
       "required": [
         "enabled",
         "debugMode",
-        "tolerations",
         "priorityClassName",
-        "extraVolumes",
-        "extraVolumeMounts",
-        "configMapKeys",
-        "extraArgs",
         "cache",
-        "kubeApiRateLimits",
-        "env"
+        "kubeApiRateLimits"
       ],
       "type": "object"
     },
@@ -1417,26 +1540,32 @@
       "additionalProperties": false,
       "properties": {
         "annotations": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "create": {
           "default": true,
           "type": "boolean"
         },
         "extraLabels": {
-          "additionalProperties": true,
-          "required": []
+          "additionalProperties": {
+            "type": "string"
+          },
+          "required": [],
+          "type": "object"
         },
         "headless": {
           "default": true,
           "type": "boolean"
         },
         "port": {
-          "default": "9793",
+          "default": 9793,
           "maximum": 65535,
           "minimum": 1,
-          "required": []
+          "type": "integer"
         }
       },
       "required": [
@@ -1471,9 +1600,6 @@
     "nameOverride",
     "fullnameOverride",
     "namespaceOverride",
-    "extraDeploy",
-    "extraDeployVerbatim",
-    "imagePullSecrets",
     "image",
     "migration",
     "exposePerCertificateErrorMetrics",
@@ -1492,8 +1618,6 @@
     "service",
     "prometheusRules",
     "priorityClassName",
-    "extraVolumes",
-    "extraVolumeMounts",
     "psp",
     "rbac",
     "rbacProxy"
diff --git a/chart/values.yaml b/chart/values.yaml
index 34e94e5..d010301 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -7,11 +7,23 @@ fullnameOverride: ""
 # -- Override the deployment namespace
 namespaceOverride: ""
 
+# @schema
+# type: array
+# items: {type: [object, string]}
+# @schema
 # -- Additional objects to deploy with the release
 extraDeploy: []
+# @schema
+# type: array
+# items: {type: [object, string]}
+# @schema
 # -- Same as `extraDeploy` but objects won't go through the templating engine
 extraDeployVerbatim: []
 
+# @schema
+# type: array
+# items: {type: object}
+# @schema
 # -- Specify docker-registry secret names as an array
 imagePullSecrets: []
 
@@ -52,16 +64,19 @@ migration:
     # -- kubectl image pull policy
     pullPolicy: IfNotPresent
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Annotations added to Helm hook Pods
   annotations: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels added to Helm hook Pods
   extraLabels: {}
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -75,6 +90,7 @@ migration:
       cpu: 20m
       memory: 20Mi
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -85,6 +101,7 @@ migration:
     seccompProfile:
       type: RuntimeDefault
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -129,13 +146,15 @@ grafana:
   # -- ConfigMap label value the Grafana sidecar is looking for
   sidecarLabelValue: "1"
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Annotations added to the Grafana dashboard ConfigMap (example in `values.yaml`)
   annotations: {}
   #  k8s-sidecar-target-directory: "/tmp/dashboards/Example"
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels added to the Grafana dashboard ConfigMap
   extraLabels: {}
@@ -144,13 +163,15 @@ secretsExporter:
   # -- Should the TLS Secrets exporter be running
   enabled: true
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional Deployment annotations
   annotations: {}
   # -- Should debug messages be produced by the TLS Secrets exporter
   debugMode: false
   # @schema
+  # type: integer
   # minimum: 1
   # @schema
   # -- Desired number of TLS Secrets exporter Pods
@@ -161,6 +182,7 @@ secretsExporter:
   # -- restartPolicy for Pods of the TLS Secrets exporter
   restartPolicy: Always
   # @schema
+  # type: object
   # additionalProperties: true
   # @schema
   # -- DeploymentStrategy for the TLS Secrets exporter
@@ -171,6 +193,7 @@ secretsExporter:
   # -- (int) Number of old ReplicaSets to retain for rollback
   revisionHistoryLimit:
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -184,6 +207,7 @@ secretsExporter:
       cpu: 20m
       memory: 20Mi
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -193,6 +217,7 @@ secretsExporter:
     initialDelaySeconds: 5
     periodSeconds: 3
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -202,13 +227,19 @@ secretsExporter:
     initialDelaySeconds: 5
     periodSeconds: 3
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Node selector for Pods of the TLS Secrets exporter
   nodeSelector: {}
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Tolerations for Pods of the TLS Secrets exporter
   tolerations: []
   # @schema
+  # type: object
   # additionalProperties: true
   # @schema
   # -- Affinity for Pods of the TLS Secrets exporter
@@ -216,16 +247,19 @@ secretsExporter:
   # -- PriorityClassName for Pods of the TLS Secrets exporter
   priorityClassName: ""
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels added to Pods of the TLS Secrets exporter
   podExtraLabels: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Annotations added to Pods of the TLS Secrets exporter
   podAnnotations: {}
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -236,6 +270,7 @@ secretsExporter:
     seccompProfile:
       type: RuntimeDefault
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -249,12 +284,21 @@ secretsExporter:
     capabilities:
       drop:
         - ALL
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional volumes added to Pods of the TLS Secrets exporter (combined with global `extraVolumes`)
   extraVolumes: []
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional volume mounts added to Pod containers of the TLS Secrets exporter (combined with global `extraVolumeMounts`)
   extraVolumeMounts: []
 
   # @schema
+  # type: array
   # items:
   #   type: object
   #   additionalProperties: false
@@ -315,6 +359,10 @@ secretsExporter:
     - type: kubernetes.io/tls
       key: tls.crt
 
+  # @schema
+  # type: array
+  # items: {type: string}
+  # @schema
   # -- If the exporter should watch for certificates in ConfigMaps, just specify the keys it needs to watch. E.g.: `configMapKeys: ["tls.crt"]`
   # @default -- see `values.yaml`
   configMapKeys: []
@@ -391,6 +439,10 @@ secretsExporter:
   # @schema
   # -- Expose selected labels from Kubernetes ConfigMaps as Prometheus labels. Same caveat as `exposeSecretLabels` — keep the list to slow-changing identifiers and avoid high-cardinality values.
   exposeConfigMapLabels: []
+  # @schema
+  # type: array
+  # items: {type: string}
+  # @schema
   # -- Additional arguments to append to the exporter command line. E.g.: `--watch-file="/extra-cert/tls.crt"`.
   extraArgs: []
 
@@ -398,6 +450,7 @@ secretsExporter:
     # -- Enable caching of Kubernetes objects to prevent scraping timeouts
     enabled: true
     # @schema
+    # type: integer
     # minimum: 1
     # @schema
     # -- Maximum time an object can stay in cache unrefreshed (seconds) - it will be at least half of that
@@ -407,17 +460,20 @@ secretsExporter:
     # -- Should requests to the Kubernetes API server be rate-limited
     enabled: false
     # @schema
+    # type: number
     # minimum: 0
     # @schema
     # -- Maximum rate of queries sent to the API server (per second)
     queriesPerSecond: 5
     # @schema
+    # type: integer
     # minimum: 1
     # @schema
     # -- Burst bucket size for queries sent to the API server
     burstQueries: 10
 
   # @schema
+  # type: integer
   # minimum: 0
   # @schema
   # -- Page size used by the paginated initial LIST against the
@@ -430,6 +486,10 @@ secretsExporter:
   # memory-constrained pods. `0` keeps the built-in default.
   listPageSize: 0
 
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional environment variables for containers
   env: []
   # - name: GOMAXPROCS
@@ -439,6 +499,7 @@ cabundlesExporter:
   # -- Should the cluster-wide caBundle exporter be active. Watches inline `caBundle` PEM fields of admission resources (and other API discovery resources) cluster-wide and emits one series per (resource, webhook entry). Opt-in because it requires cluster-scoped get+list+watch on the corresponding API groups.
   enabled: false
   # @schema
+  # type: object
   # additionalProperties: false
   # @schema
   # -- Per-resource opt-in. Each true flag adds the corresponding rule to the ClusterRole and starts the matching informer. Toggle off the resource kinds you don't use to keep the RBAC scope minimal.
@@ -484,7 +545,8 @@ cabundlesExporter:
 
 hostPathsExporter:
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional DaemonSet annotations
   annotations: {}
@@ -500,6 +562,7 @@ hostPathsExporter:
   # -- restartPolicy for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
   restartPolicy: Always
   # @schema
+  # type: object
   # additionalProperties: true
   # @schema
   # -- updateStrategy for DaemonSets of hostPath exporters (default for all hostPathsExporter.daemonSets)
@@ -510,6 +573,7 @@ hostPathsExporter:
   # -- (int) Number of old ReplicaSets to retain for rollback (default for all hostPathsExporter.daemonSets)
   revisionHistoryLimit:
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -523,6 +587,7 @@ hostPathsExporter:
       cpu: 10m
       memory: 20Mi
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -532,6 +597,7 @@ hostPathsExporter:
     initialDelaySeconds: 5
     periodSeconds: 3
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -541,13 +607,19 @@ hostPathsExporter:
     initialDelaySeconds: 5
     periodSeconds: 3
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Node selector for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
   nodeSelector: {}
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Tolerations for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
   tolerations: []
   # @schema
+  # type: object
   # additionalProperties: true
   # @schema
   # -- Affinity for Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
@@ -555,16 +627,19 @@ hostPathsExporter:
   # -- PriorityClassName for Pods of hostPath exporters
   priorityClassName: ""
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
   podExtraLabels: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Annotations added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets)
   podAnnotations: {}
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -574,6 +649,7 @@ hostPathsExporter:
     seccompProfile:
       type: RuntimeDefault
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -587,8 +663,16 @@ hostPathsExporter:
     capabilities:
       drop:
         - ALL
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional volumes added to Pods of hostPath exporters (default for all hostPathsExporter.daemonSets ; combined with global `extraVolumes`)
   extraVolumes: []
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional volume mounts added to Pod containers of hostPath exporters (default for all hostPathsExporter.daemonSets ; combined with global `extraVolumeMounts`)
   extraVolumeMounts: []
 
@@ -598,27 +682,49 @@ hostPathsExporter:
   # @schema
   # -- Type for HostPath volumes used with watched paths. Can be set to `""` or null to use Kubernetes defaults. May be required with RKE if Pods don't start.
   hostPathVolumeType: Directory
+  # @schema
+  # type: array
+  # items: {type: string}
+  # @schema
   # -- [SEE README] List of directory paths of the host to scan for PEM encoded certificate files to be watched and exported as metrics. Each entry is a literal directory (scanned one level deep, default) or a shell-glob pattern with `**` for recursion — e.g. `/var/lib/kubelet/pods/**/*.crt` walks every Pod's volume subtree. The static prefix before any `*`/`?`/`[`/`**` is what gets mounted from the host, so a recursive pattern still binds the smallest containing directory rather than the whole filesystem.
   watchDirectories: []
+  # @schema
+  # type: array
+  # items: {type: string}
+  # @schema
   # -- [SEE README] List of directory paths of the host to scan for specific extension files to be watched and exported as metrics (one level deep)
   watchSpecificExtensionDirectories: []
+  # @schema
+  # type: array
+  # items: {type: string}
+  # @schema
   # -- [SEE README] List of file paths of the host for PEM encoded certificates to be watched and exported as metrics (one level deep)
   watchFiles: []
+  # @schema
+  # type: array
+  # items: {type: string}
+  # @schema
   # -- [SEE README] List of Kubeconf file paths of the host to scan for embedded certificates to export metrics about
   watchKubeconfFiles: []
 
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional environment variables for containers
   env: []
   # - name: GOMAXPROCS
   #   value: "1"
 
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: object}
   # @schema
   # -- [SEE README] Map to define one or many DaemonSets running hostPath exporters. Key is used as a name ; value is a map to override all default settings set by `hostPathsExporter.*`.
   daemonSets: {}
 
 # @schema
+# type: integer
 # minimum: 1
 # maximum: 65535
 # @schema
@@ -626,6 +732,7 @@ hostPathsExporter:
 podListenPort: 9793
 
 # @schema
+# type: integer
 # minimum: 0
 # maximum: 65535
 # @schema
@@ -656,24 +763,28 @@ service:
   # -- Should the Service be headless (`clusterIP: None`).
   headless: true
   # @schema
+  # type: integer
   # minimum: 1
   # maximum: 65535
   # @schema
   # -- TCP port to expose the Service on
   port: 9793
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Annotations to add to the Service
   annotations: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels to add to the Service
   extraLabels: {}
 
 # @schema
-# additionalProperties: true
+# type: object
+# additionalProperties: false
 # @schema
 prometheusServiceMonitor:
   # -- Should a ServiceMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users.
@@ -683,17 +794,27 @@ prometheusServiceMonitor:
   # -- Target scrape timeout set in the ServiceMonitor
   scrapeTimeout: 30s
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels to add to ServiceMonitor objects
   extraLabels: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional annotations to add to ServiceMonitor objects
   extraAnnotations: {}
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
   metricRelabelings: []
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
   relabelings: []
   # @schema
@@ -702,13 +823,21 @@ prometheusServiceMonitor:
   # -- Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
   scheme: http
   # @schema
+  # type: object
+  # additionalProperties: true
+  # @schema
+  # -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
+  basicAuth: {}
+  # @schema
+  # type: object
   # additionalProperties: true
   # @schema
   # -- Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig
   tlsConfig: {}
 
 # @schema
-# additionalProperties: true
+# type: object
+# additionalProperties: false
 # @schema
 prometheusPodMonitor:
   # -- Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users.
@@ -718,12 +847,21 @@ prometheusPodMonitor:
   # -- Target scrape timeout set in the PodMonitor
   scrapeTimeout: 30s
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels to add to PodMonitor objects
   extraLabels: {}
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
   metricRelabelings: []
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
   relabelings: []
   # @schema
@@ -732,6 +870,13 @@ prometheusPodMonitor:
   # -- Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint
   scheme: http
   # @schema
+  # type: object
+  # additionalProperties: true
+  # @schema
+  # -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
+  basicAuth: {}
+  # @schema
+  # type: object
   # additionalProperties: true
   # @schema
   # -- Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig
@@ -743,17 +888,20 @@ prometheusRules:
   # -- Prefix prepended to the alert rule names of PrometheusRule rules
   rulePrefix: ""
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels to add to PrometheusRule objects
   extraLabels: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional labels to add to PrometheusRule rules
   alertExtraLabels: {}
   # @schema
-  # additionalProperties: true
+  # type: object
+  # additionalProperties: {type: string}
   # @schema
   # -- Additional annotations to add to PrometheusRule rules
   alertExtraAnnotations: {}
@@ -821,11 +969,13 @@ prometheusRules:
   # -- Severity for the CertificateExpiration alerting rule
   certificateExpirationsSeverity: critical
   # @schema
+  # type: integer
   # minimum: 0
   # @schema
   # -- Raise a warning alert when fewer than this many days are left before a certificate expiration (cert-manager would renew Let's Encrypt certs before day 29)
   warningDaysLeft: 28
   # @schema
+  # type: integer
   # minimum: 0
   # @schema
   # -- Raise a critical alert when fewer than this many days are left before a certificate expiration (two weeks to deal with ACME rate limiting should this be an issue)
@@ -850,6 +1000,7 @@ prometheusRules:
   # underlying `x509_crl_*` series only exist when a CRL is actually
   # observed, so installations that don't watch any CRL get no alerts.
   # @schema
+  # type: integer
   # minimum: 0
   # @schema
   # -- Raise a warning alert when fewer than this many days are left before a CRL reaches its nextUpdate. CRLs are typically refreshed daily to weekly; 7 days gives a comfortable margin for a publisher running on a weekly cadence.
@@ -867,6 +1018,10 @@ prometheusRules:
 
   # -- Skip all built-in alerts when using extraAlertGroups
   disableBuiltinAlertGroup: false
+  # @schema
+  # type: array
+  # items: {type: object}
+  # @schema
   # -- Additional alert groups for custom configuration (example in `values.yaml`)
   extraAlertGroups: []
   # - name: x509-certificate-exporter.custom
@@ -916,19 +1071,22 @@ prometheusRules:
   #   CertificateError: "1m"
 
 # @schema
-# additionalProperties: true
+# type: object
+# additionalProperties: {type: string}
 # @schema
 # -- Additional labels added to all chart objects
 extraLabels: {}
 
 # @schema
-# additionalProperties: true
+# type: object
+# additionalProperties: {type: string}
 # @schema
 # -- Additional labels added to all Pods
 podExtraLabels: {}
 
 # @schema
-# additionalProperties: true
+# type: object
+# additionalProperties: {type: string}
 # @schema
 # -- Annotations added to all Pods
 podAnnotations: {}
@@ -938,9 +1096,17 @@ podAnnotations: {}
 # -- PriorityClassName set for all Pods by default (can be overridden with `secretsExporter` and `hostPathsExporter` specific values)
 priorityClassName: ""
 
+# @schema
+# type: array
+# items: {type: object}
+# @schema
 # -- Additional volumes added to all Pods (see also the `secretsExporter` and `hostPathsExporter` variants)
 extraVolumes: []
 
+# @schema
+# type: array
+# items: {type: object}
+# @schema
 # -- Additional volume mounts added to all Pod containers (see also the `secretsExporter` and `hostPathsExporter` variants)
 extraVolumeMounts: []
 
@@ -959,17 +1125,20 @@ rbac:
     # -- Name of the ServiceAccount for the Secrets exporter (required if `rbac.create=false`)
     serviceAccountName:
     # @schema
-    # additionalProperties: true
+    # type: object
+    # additionalProperties: {type: string}
     # @schema
     # -- Annotations added to the ServiceAccount for the Secrets exporter
     serviceAccountAnnotations: {}
     # @schema
-    # additionalProperties: true
+    # type: object
+    # additionalProperties: {type: string}
     # @schema
     # -- Annotations added to the ClusterRole for the Secrets exporter
     clusterRoleAnnotations: {}
     # @schema
-    # additionalProperties: true
+    # type: object
+    # additionalProperties: {type: string}
     # @schema
     # -- Annotations added to the ClusterRoleBinding for the Secrets exporter
     clusterRoleBindingAnnotations: {}
@@ -981,17 +1150,20 @@ rbac:
     # -- Name of the ServiceAccount for hostPath exporters (required if `rbac.create=false`)
     serviceAccountName:
     # @schema
-    # additionalProperties: true
+    # type: object
+    # additionalProperties: {type: string}
     # @schema
     # -- Annotations added to the ServiceAccount for the hostPath exporters
     serviceAccountAnnotations: {}
     # @schema
-    # additionalProperties: true
+    # type: object
+    # additionalProperties: {type: string}
     # @schema
     # -- Annotations added to the ClusterRole for the hostPath exporters
     clusterRoleAnnotations: {}
     # @schema
-    # additionalProperties: true
+    # type: object
+    # additionalProperties: {type: string}
     # @schema
     # -- Annotations added to the ClusterRoleBinding for the hostPath exporters
     clusterRoleBindingAnnotations: {}
@@ -1025,12 +1197,14 @@ rbacProxy:
     # -- kube-rbac-proxy image pull policy
     pullPolicy: IfNotPresent
   # @schema
+  # type: integer
   # minimum: 1
   # maximum: 65535
   # @schema
   # -- Listen port for the exporter running inside kube-rbac-proxy exposed Pods
   upstreamListenPort: 9091
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
@@ -1044,6 +1218,7 @@ rbacProxy:
       cpu: 10m
       memory: 20Mi
   # @schema
+  # type: object
   # additionalProperties: true
   # properties: {}
   # @schema
diff --git a/test/schema/invalid/daemonsets-scalar-value.expect.txt b/test/schema/invalid/daemonsets-scalar-value.expect.txt
new file mode 100644
index 0000000..716274a
--- /dev/null
+++ b/test/schema/invalid/daemonsets-scalar-value.expect.txt
@@ -0,0 +1 @@
+at '/hostPathsExporter/daemonSets/edge'
diff --git a/test/schema/invalid/daemonsets-scalar-value.yaml b/test/schema/invalid/daemonsets-scalar-value.yaml
new file mode 100644
index 0000000..6482524
--- /dev/null
+++ b/test/schema/invalid/daemonsets-scalar-value.yaml
@@ -0,0 +1,6 @@
+# `hostPathsExporter.daemonSets` is a map of override *objects* — a
+# scalar value is always a config mistake (the chart would range over
+# it and produce a broken DaemonSet).
+hostPathsExporter:
+  daemonSets:
+    edge: "oops"
diff --git a/test/schema/invalid/extralabels-nonstring-value.expect.txt b/test/schema/invalid/extralabels-nonstring-value.expect.txt
new file mode 100644
index 0000000..47a767e
--- /dev/null
+++ b/test/schema/invalid/extralabels-nonstring-value.expect.txt
@@ -0,0 +1 @@
+at '/extraLabels/team'
diff --git a/test/schema/invalid/extralabels-nonstring-value.yaml b/test/schema/invalid/extralabels-nonstring-value.yaml
new file mode 100644
index 0000000..60f186a
--- /dev/null
+++ b/test/schema/invalid/extralabels-nonstring-value.yaml
@@ -0,0 +1,4 @@
+# Label maps are string→string: a numeric value renders an invalid K8s
+# object (labels must be strings) — reject it at install time instead.
+extraLabels:
+  team: 42
diff --git a/test/schema/invalid/podannotations-as-string.expect.txt b/test/schema/invalid/podannotations-as-string.expect.txt
new file mode 100644
index 0000000..b9754ef
--- /dev/null
+++ b/test/schema/invalid/podannotations-as-string.expect.txt
@@ -0,0 +1 @@
+at '/podAnnotations'
diff --git a/test/schema/invalid/podannotations-as-string.yaml b/test/schema/invalid/podannotations-as-string.yaml
new file mode 100644
index 0000000..2d256b7
--- /dev/null
+++ b/test/schema/invalid/podannotations-as-string.yaml
@@ -0,0 +1,3 @@
+# Annotation maps must be objects — a plain string here used to be
+# accepted by the schema and blow up only at template-render time.
+podAnnotations: "prometheus.io/scrape=true"
diff --git a/test/schema/invalid/podlistenport-string.expect.txt b/test/schema/invalid/podlistenport-string.expect.txt
new file mode 100644
index 0000000..79b0085
--- /dev/null
+++ b/test/schema/invalid/podlistenport-string.expect.txt
@@ -0,0 +1 @@
+at '/podListenPort'
diff --git a/test/schema/invalid/podlistenport-string.yaml b/test/schema/invalid/podlistenport-string.yaml
new file mode 100644
index 0000000..fcb9094
--- /dev/null
+++ b/test/schema/invalid/podlistenport-string.yaml
@@ -0,0 +1,4 @@
+# Ports are `type: integer` now — a quoted value is a string and must
+# be rejected, not coerced. `podListenPort: "9793"` used to render fine
+# and break subtly wherever the chart does arithmetic on it.
+podListenPort: "9793"
diff --git a/test/schema/invalid/replicas-string.expect.txt b/test/schema/invalid/replicas-string.expect.txt
new file mode 100644
index 0000000..5d2f6f4
--- /dev/null
+++ b/test/schema/invalid/replicas-string.expect.txt
@@ -0,0 +1 @@
+at '/secretsExporter/replicas'
diff --git a/test/schema/invalid/replicas-string.yaml b/test/schema/invalid/replicas-string.yaml
new file mode 100644
index 0000000..aec92b6
--- /dev/null
+++ b/test/schema/invalid/replicas-string.yaml
@@ -0,0 +1,4 @@
+# `replicas` is an integer — a quoted number is a string and must be
+# rejected instead of coerced.
+secretsExporter:
+  replicas: "2"
diff --git a/test/schema/invalid/servicemonitor-unknown-key.expect.txt b/test/schema/invalid/servicemonitor-unknown-key.expect.txt
new file mode 100644
index 0000000..a797675
--- /dev/null
+++ b/test/schema/invalid/servicemonitor-unknown-key.expect.txt
@@ -0,0 +1,2 @@
+at '/prometheusServiceMonitor'
+enbled
diff --git a/test/schema/invalid/servicemonitor-unknown-key.yaml b/test/schema/invalid/servicemonitor-unknown-key.yaml
new file mode 100644
index 0000000..f2353cc
--- /dev/null
+++ b/test/schema/invalid/servicemonitor-unknown-key.yaml
@@ -0,0 +1,5 @@
+# `prometheusServiceMonitor` is now a closed object: a typoed key must
+# be rejected instead of silently ignored — before 4.2.0 `enbled` here
+# would deploy with the default and nobody would notice.
+prometheusServiceMonitor:
+  enbled: false
diff --git a/test/schema/invalid/tolerations-string-item.expect.txt b/test/schema/invalid/tolerations-string-item.expect.txt
new file mode 100644
index 0000000..639dd31
--- /dev/null
+++ b/test/schema/invalid/tolerations-string-item.expect.txt
@@ -0,0 +1 @@
+at '/secretsExporter/tolerations/0'
diff --git a/test/schema/invalid/tolerations-string-item.yaml b/test/schema/invalid/tolerations-string-item.yaml
new file mode 100644
index 0000000..369850c
--- /dev/null
+++ b/test/schema/invalid/tolerations-string-item.yaml
@@ -0,0 +1,5 @@
+# Tolerations are objects (K8s Toleration) — a bare string is a
+# malformed entry that kubectl would reject much later.
+secretsExporter:
+  tolerations:
+    - "node-role.kubernetes.io/control-plane"
diff --git a/test/schema/invalid/watchdirectories-nonstring-item.expect.txt b/test/schema/invalid/watchdirectories-nonstring-item.expect.txt
new file mode 100644
index 0000000..0a69619
--- /dev/null
+++ b/test/schema/invalid/watchdirectories-nonstring-item.expect.txt
@@ -0,0 +1 @@
+at '/hostPathsExporter/watchDirectories/0'
diff --git a/test/schema/invalid/watchdirectories-nonstring-item.yaml b/test/schema/invalid/watchdirectories-nonstring-item.yaml
new file mode 100644
index 0000000..0846d1d
--- /dev/null
+++ b/test/schema/invalid/watchdirectories-nonstring-item.yaml
@@ -0,0 +1,5 @@
+# watch lists are arrays of path strings — a bare number is a typo'd
+# path and must be rejected instead of being stringified downstream.
+hostPathsExporter:
+  watchDirectories:
+    - 42
diff --git a/test/schema/valid/daemonsets-object-override.yaml b/test/schema/valid/daemonsets-object-override.yaml
new file mode 100644
index 0000000..f4c21cc
--- /dev/null
+++ b/test/schema/valid/daemonsets-object-override.yaml
@@ -0,0 +1,12 @@
+# Lock-down: daemonSets values are free-form override objects — any
+# subset of the hostPathsExporter knobs must be accepted per entry.
+hostPathsExporter:
+  daemonSets:
+    nodes:
+      debugMode: true
+      watchDirectories:
+        - /etc/kubernetes/pki
+    edge:
+      tolerations:
+        - operator: Exists
+          effect: NoSchedule
diff --git a/test/schema/valid/extradeploy-string-and-object.yaml b/test/schema/valid/extradeploy-string-and-object.yaml
new file mode 100644
index 0000000..060776a
--- /dev/null
+++ b/test/schema/valid/extradeploy-string-and-object.yaml
@@ -0,0 +1,23 @@
+# Lock-down: extraDeploy accepts BOTH raw-string manifests (run through
+# `tpl`) and structured objects — the template branches on `typeIs
+# "string"`. A future schema tightening to objects-only would break the
+# documented string form.
+extraDeploy:
+  - |
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: {{ .Release.Name }}-extra
+    data: {}
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: extra-object
+    data: {}
+extraDeployVerbatim:
+  - |
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: verbatim-extra
+    data: {}
diff --git a/test/schema/valid/monitors-all-keys.yaml b/test/schema/valid/monitors-all-keys.yaml
new file mode 100644
index 0000000..4f6935e
--- /dev/null
+++ b/test/schema/valid/monitors-all-keys.yaml
@@ -0,0 +1,42 @@
+# Lock-down: the complete declared key set of both monitor objects —
+# they are closed structures now (additionalProperties: false), so this
+# fixture fails if a template-consumed key ever goes missing from the
+# schema.
+prometheusServiceMonitor:
+  create: true
+  scrapeInterval: 30s
+  scrapeTimeout: 10s
+  extraLabels:
+    release: prom
+  extraAnnotations:
+    note: managed
+  metricRelabelings: []
+  relabelings: []
+  scheme: https
+  basicAuth:
+    username:
+      name: scrape-creds
+      key: username
+    password:
+      name: scrape-creds
+      key: password
+  tlsConfig:
+    insecureSkipVerify: true
+prometheusPodMonitor:
+  create: true
+  scrapeInterval: 30s
+  scrapeTimeout: 10s
+  extraLabels:
+    release: prom
+  metricRelabelings: []
+  relabelings: []
+  scheme: https
+  basicAuth:
+    username:
+      name: scrape-creds
+      key: username
+    password:
+      name: scrape-creds
+      key: password
+  tlsConfig:
+    insecureSkipVerify: true
diff --git a/test/schema/valid/stringmaps-and-passthrough-arrays.yaml b/test/schema/valid/stringmaps-and-passthrough-arrays.yaml
new file mode 100644
index 0000000..c9bef2d
--- /dev/null
+++ b/test/schema/valid/stringmaps-and-passthrough-arrays.yaml
@@ -0,0 +1,41 @@
+# Lock-down for the 4.2.0 strictness pass: every newly-typed container
+# keeps accepting its legitimate documented shape — string label/
+# annotation maps, K8s object arrays (tolerations, env, volumes,
+# relabelings), string path lists.
+extraLabels:
+  team: platform
+podAnnotations:
+  prometheus.io/scrape: "true"
+secretsExporter:
+  nodeSelector:
+    kubernetes.io/os: linux
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  env:
+    - name: GOMAXPROCS
+      value: "1"
+  extraArgs:
+    - --watch-file=/extra-cert/tls.crt
+  extraVolumes:
+    - name: extra-cert
+      secret:
+        secretName: extra-cert
+  extraVolumeMounts:
+    - name: extra-cert
+      mountPath: /extra-cert
+      readOnly: true
+hostPathsExporter:
+  watchDirectories:
+    - /etc/kubernetes/pki
+    - /var/lib/kubelet/pods/**/*.crt
+prometheusServiceMonitor:
+  extraLabels:
+    release: kube-prometheus-stack
+  metricRelabelings:
+    - action: labeldrop
+      regex: temporary_label
+  relabelings:
+    - sourceLabels: [__meta_kubernetes_pod_node_name]
+      targetLabel: node