diff --git a/BUILD_AND_TEST.md b/BUILD_AND_TEST.md
index b941e327d..bc52945de 100644
--- a/BUILD_AND_TEST.md
+++ b/BUILD_AND_TEST.md
@@ -232,7 +232,7 @@ This command:
 
 - Creates a KIND cluster if it does not exist
 - Sets up the OSMO namespace and image pull secrets
-- Installs ingress-nginx controller
+- Installs gateway (Envoy) for routing traffic
 - Generates the Master Encryption Key (MEK)
 - Installs core OSMO services (osmo, ui, router)
 
@@ -240,14 +240,14 @@ Add the following line to your `/etc/hosts` file. If you are SSH-ing into a remo
 must add this line to `/etc/hosts` on both your local and remote hosts.
 
 ```text
-127.0.0.1 ingress-nginx-controller.ingress-nginx.svc.cluster.local
+127.0.0.1 quick-start.osmo
 ```
 
 If you are SSH-ing into a remote workstation, you must also forward port `:80` from your remote
 workstation to your local host.
 
 The OSMO UI and APIs for the core service can now be accessed on your local machine at:
-http://ingress-nginx-controller.ingress-nginx.svc.cluster.local
+http://quick-start.osmo
 
 ### Start OSMO Backend
 
@@ -300,12 +300,12 @@ This command:
 ### Access OSMO
 
 The OSMO UI and APIs can be accessed at:
-http://ingress-nginx-controller.ingress-nginx.svc.cluster.local
+http://quick-start.osmo
 
 Log into OSMO using the CLI:
 
 ```sh
-bazel run @osmo_workspace//src/cli -- login http://ingress-nginx-controller.ingress-nginx.svc.cluster.local --method=dev --username=testuser
+bazel run @osmo_workspace//src/cli -- login http://quick-start.osmo --method=dev --username=testuser
 ```
 
 ## Next steps
@@ -332,7 +332,7 @@ Note: If you used a different `--cluster-name` than the default `osmo`, delete t
 
 ## FAQ
 
-### How do I resolve the issue where `start_service` fails to install helm charts such as `ingress-nginx`?
+### How do I resolve the issue where `start_service` fails to install helm charts?
 
 This is likely caused by running out of [inotify](https://linux.die.net/man/7/inotify) resources.
 Follow
diff --git a/deployments/brev/README.md b/deployments/brev/README.md
index 500c48a5f..4204281a1 100644
--- a/deployments/brev/README.md
+++ b/deployments/brev/README.md
@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION. All rights reserved.
+SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION. All rights reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -39,7 +39,8 @@ The OSMO Web UI is available through a secure Brev link exposed from your instan
 1. Log in to your Brev console at https://console.brev.dev
 2. Navigate to your OSMO instance
 3. Select "Access"
-4. Click on the "Secure Link" for port `8000`
+4. Under `Using Secure Links`, click `Share a Service` and enter port `8000`
+5. Click on the "Shareable URL" for port `8000`
 
 ## [Optional] Local CLI Setup
 
@@ -55,16 +56,6 @@ Forward port 8000 from your Brev instance to local port 80. This port will need
 
 You can find your instance's IP address at the top of the deployment page.
 
-```bash
-# Find your instance name with brev ls
-sudo ssh -i ~/.brev/brev.pem -p 22 -L 80:localhost:8000 shadeform@[your instance IP]
-```
-
-If you see `Permission denied (publickey)` it may be because:
-
-- You did not log in using `brev auth`
-- The username is different than `shadeform`
-
 You can see your username in the Brev Console:
 
 1. Log in to your Brev console at https://console.brev.dev
@@ -72,7 +63,14 @@ You can see your username in the Brev Console:
 3. Select "Logs"
 4. Look at the output of "Script Logs". You should see `Current user: [brev instance username]`
 
-Use the Brev instance username in the above ssh command instead of `shadeform`.
+```bash
+# Find your instance name with brev ls
+sudo ssh -i ~/.brev/brev.pem -p 22 -L 80:localhost:8000 <username>@[your instance IP]
+```
+
+If you see `Permission denied (publickey)` it may be because:
+
+- You did not log in using `brev login`
 
 ### Step 3: Set Up Networking
 
@@ -116,7 +114,7 @@ Visit the [User Guide](https://nvidia.github.io/OSMO/main/user_guide/getting_sta
 Close the port-forward session with:
 
 ```bash
-kill -9 $(lsof -ti:8000)
+sudo kill -9 $(sudo lsof -ti:80)
 ```
 
 Delete your Brev instance through the Brev console or CLI:
@@ -124,3 +122,34 @@ Delete your Brev instance through the Brev console or CLI:
 ```bash
 brev delete [your instance name]
 ```
+
+# Deploying Custom OSMO Chart
+
+1. Build and push your quick-start chart to the registry.
+
+2. Go to [brev.nvidia.com](https://brev.nvidia.com) and create a new environment.
+   - **L40S 1xGPU** on MassedCompute works well, but any L40 or L40S instance should work.
+
+3. Wait for the node to finish starting up.
+
+4. Shell into the instance:
+
+   ```bash
+   brev shell <your node name>
+   ```
+
+5. Download the setup script:
+
+   ```bash
+   curl -o setup.sh https://raw.githubusercontent.com/NVIDIA/OSMO/main/deployments/brev/setup.sh && chmod +x setup.sh
+   ```
+
+6. Edit `setup.sh` to install your version and use your registry key
+
+7. Run the setup script:
+
+   ```bash
+   ./setup.sh
+   ```
+
+Once you are complete, you can follow the instructions above on to access your Brev instance.
diff --git a/deployments/charts/quick-start/Chart.yaml b/deployments/charts/quick-start/Chart.yaml
index e08369d7c..67c146836 100644
--- a/deployments/charts/quick-start/Chart.yaml
+++ b/deployments/charts/quick-start/Chart.yaml
@@ -22,9 +22,6 @@ type: application
 version: 1.2.1
 
 dependencies:
-- name: ingress-nginx
-  version: 4.13.2
-  repository: https://kubernetes.github.io/ingress-nginx
 - name: service
   version: 1.2.1
   repository: file://../service
diff --git a/deployments/charts/quick-start/README.md b/deployments/charts/quick-start/README.md
index 018668299..caec6472c 100644
--- a/deployments/charts/quick-start/README.md
+++ b/deployments/charts/quick-start/README.md
@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -32,7 +32,7 @@ Before installing this chart, you must install the KAI scheduler in a separate n
 ```bash
 helm upgrade --install kai-scheduler \
   oci://ghcr.io/nvidia/kai-scheduler/kai-scheduler \
-  --version v0.8.1 \
+  --version v0.12.10 \
   --create-namespace -n kai-scheduler \
   --set global.nodeSelector.node_group=kai-scheduler \
   --set "scheduler.additionalArgs[0]=--default-staleness-grace-period=-1s" \
@@ -44,7 +44,7 @@ helm upgrade --install kai-scheduler \
 
 This chart installs and configures:
 
-1. **Ingress NGINX Controller** - For routing traffic to OSMO services
+1. **Gateway (Envoy)** - Routes all external traffic to OSMO services
 2. **Data infrastructure** - PostgreSQL, Redis, Localstack S3
 3. **OSMO Core Services**:
    - OSMO service (API server, worker, logger, agent)
@@ -72,16 +72,17 @@ This chart installs and configures:
 | `global.objectStorage.accessKey`        | Object storage access key for authentication                            | `"test"`                           |
 | `global.objectStorage.region`           | Object storage region where the bucket is located                       | `"us-east-1"`                      |
 
-### Ingress NGINX Configuration
+### Gateway Configuration
 
 | Parameter                                          | Description                                              | Default                           |
 | -------------------------------------------------- | -------------------------------------------------------- | --------------------------------- |
-| `ingress-nginx.fullnameOverride`                   | Override the full name of ingress-nginx resources        | `quick-start`                     |
-| `ingress-nginx.controller.name`                    | Controller name suffix (empty string removes the suffix) | `""`                              |
-| `ingress-nginx.controller.nodeSelector.node_group` | Node group for ingress controller                        | `ingress`                         |
-| `ingress-nginx.controller.service.type`            | Service type for ingress controller                      | `NodePort`                        |
-| `ingress-nginx.controller.service.nodePorts.http`  | HTTP NodePort for external access                        | `30080`                           |
-| `ingress-nginx.controller.extraInitContainers`     | Init containers for ingress controller                   | Wait for osmo-ui (web UI service) |
+| `service.gateway.envoy.scaling.minReplicas`        | Minimum number of Envoy replicas                         | `1`                               |
+| `service.gateway.envoy.scaling.maxReplicas`        | Maximum number of Envoy replicas                         | `1`                               |
+| `service.gateway.envoy.service.type`               | Service type for external gateway                        | `NodePort`                        |
+| `service.gateway.envoy.service.nodePort`           | NodePort for external access (matches KIND port mapping) | `30080`                           |
+| `service.gateway.envoy.service.httpsPort`          | HTTPS port (null for HTTP-only local dev)                | `null`                            |
+| `service.gateway.oauth2Proxy.enabled`              | Enable OAuth2 proxy                                      | `false`                           |
+| `service.gateway.authz.enabled`                    | Enable authorization sidecar                             | `false`                           |
 
 ### OSMO Service Configuration
 
@@ -105,11 +106,10 @@ This chart installs and configures:
 | `service.services.localstackS3.persistence.enabled`     | Enable Localstack S3 persistence                                 | `true`                                      |
 | `service.services.localstackS3.persistence.hostPath`    | Path to Localstack S3 persistence on the host                    | `/var/lib/localstack`                       |
 | `service.services.localstackS3.nodeSelector.node_group` | Node group for Localstack S3 pods                                | `data`                                      |
-| `service.services.service.hostname`                     | Hostname for OSMO service ingress                                | `quick-start.osmo`                          |
+| `service.services.service.hostname`                     | Hostname for OSMO service                                        | `quick-start.osmo`                          |
 | `service.services.service.imagePullPolicy`              | Kubernetes image pull policy for the API service                 | `IfNotPresent`                              |
 | `service.services.service.scaling.minReplicas`          | Minimum number of service replicas                               | `1`                                         |
 | `service.services.service.scaling.maxReplicas`          | Maximum number of service replicas                               | `1`                                         |
-| `service.services.service.ingress.sslEnabled`           | Enable SSL for service ingress                                   | `false`                                     |
 | `service.services.service.initContainers`               | Init containers for API service                                  | Wait for postgres, redis, and localstack-s3 |
 | `service.services.worker.imagePullPolicy`               | Kubernetes image pull policy for the worker service              | `IfNotPresent`                              |
 | `service.services.worker.scaling.minReplicas`           | Minimum number of worker replicas                                | `1`                                         |
@@ -129,12 +129,12 @@ This chart installs and configures:
 
 ### Web UI Configuration
 
-| Parameter                               | Description                          | Default               |
-| --------------------------------------- | ------------------------------------ | --------------------- |
-| `web-ui.services.ui.initContainers`     | Init containers for UI service       | Wait for osmo-service |
-| `web-ui.services.ui.skipAuth`           | Skip authentication for UI service   | `true`                |
-| `web-ui.services.ui.hostname`           | Hostname for UI service              | `quick-start.osmo`    |
-| `web-ui.services.ui.ingress.sslEnabled` | Enable SSL for UI ingress            | `false`               |
+| Parameter                               | Description                          | Default                                    |
+| --------------------------------------- | ------------------------------------ | ------------------------------------------ |
+| `web-ui.services.ui.initContainers`     | Init containers for UI service       | Wait for osmo-service                      |
+| `web-ui.services.ui.skipAuth`           | Skip authentication for UI service   | `true`                                     |
+| `web-ui.services.ui.hostname`           | Hostname for UI service              | `quick-start.osmo`                         |
+| `web-ui.services.ui.apiHostname`        | API hostname for server-side rendering | `osmo-gateway.osmo.svc.cluster.local:80` |
 
 ### Router Service Configuration
 
@@ -146,32 +146,31 @@ This chart installs and configures:
 | `router.services.service.imagePullPolicy`     | Kubernetes image pull policy for the router service     | `IfNotPresent`               |
 | `router.services.service.scaling.minReplicas` | Minimum number of router service replicas               | `1`                          |
 | `router.services.service.scaling.maxReplicas` | Maximum number of router service replicas               | `1`                          |
-| `router.services.service.ingress.sslEnabled`  | Enable SSL for router ingress                           | `false`                      |
 | `router.services.service.initContainers`      | Init containers for router service                      | Wait for postgres and redis  |
 | `router.services.postgres.password`           | PostgreSQL password for router                          | `"osmo"`                     |
 
 ### Backend Operator Configuration
 
-| Parameter                                                             | Description                                                   | Default                      |
-| --------------------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------- |
-| `backend-operator.global.serviceUrl`                                  | OSMO service URL for backend operator                         | `http://quick-start.osmo`    |
-| `backend-operator.global.agentNamespace`                              | Kubernetes namespace for backend operator                     | `osmo`                       |
-| `backend-operator.global.backendNamespace`                            | Kubernetes namespace for backend workloads                    | `default`                    |
-| `backend-operator.global.backendTestNamespace`                        | Kubernetes namespace for backend test workloads               | `osmo-test`                  |
-| `backend-operator.global.backendName`                                 | Backend name identifier                                       | `default`                    |
-| `backend-operator.global.accountTokenSecret`                          | Secret name containing backend operator authentication token  | `backend-operator-token`     |
-| `backend-operator.global.loginMethod`                                 | Authentication method for backend operator                    | `token`                      |
-| `backend-operator.services.backendListener.imagePullPolicy`           | Kubernetes image pull policy for the backend listener service | `IfNotPresent`               |
-| `backend-operator.services.backendListener.initContainers`            | Init containers for backend listener service                  | Wait for quick-start ingress |
-| `backend-operator.services.backendListener.resources.requests.cpu`    | CPU resource requests for backend listener container          | `"125m"`                     |
-| `backend-operator.services.backendListener.resources.requests.memory` | Memory resource requests for backend listener container       | `"128Mi"`                    |
-| `backend-operator.services.backendListener.resources.limits.cpu`      | CPU resource limits for backend listener container            | `"250m"`                     |
-| `backend-operator.services.backendListener.resources.limits.memory`   | Memory resource limits for backend listener container         | `"256Mi"`                    |
-| `backend-operator.services.backendWorker.imagePullPolicy`             | Kubernetes image pull policy for the backend worker service   | `IfNotPresent`               |
-| `backend-operator.services.backendWorker.initContainers`              | Init containers for backend worker service                    | Wait for quick-start ingress |
-| `backend-operator.services.backendWorker.resources.requests.cpu`      | CPU resource requests for backend worker container            | `"125m"`                     |
-| `backend-operator.services.backendWorker.resources.requests.memory`   | Memory resource requests for backend worker container         | `"128Mi"`                    |
-| `backend-operator.services.backendWorker.resources.limits.cpu`        | CPU resource limits for backend worker container              | `"250m"`                     |
-| `backend-operator.services.backendWorker.resources.limits.memory`     | Memory resource limits for backend worker container           | `"256Mi"`                    |
-| `backend-operator.backendTestRunner.enabled`                          | Enable backend test runner                                    | `false`                      |
-| `backend-operator.podMonitor.enabled`                                 | Enable PodMonitor for Prometheus scraping (requires `monitoring.coreos.com` CRD) | `false`       |
+| Parameter                                                             | Description                                                   | Default                                         |
+| --------------------------------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------- |
+| `backend-operator.global.serviceUrl`                                  | OSMO service URL for backend operator                         | `http://osmo-gateway.osmo.svc.cluster.local`    |
+| `backend-operator.global.agentNamespace`                              | Kubernetes namespace for backend operator                     | `osmo`                                          |
+| `backend-operator.global.backendNamespace`                            | Kubernetes namespace for backend workloads                    | `default`                                       |
+| `backend-operator.global.backendTestNamespace`                        | Kubernetes namespace for backend test workloads               | `osmo-test`                                     |
+| `backend-operator.global.backendName`                                 | Backend name identifier                                       | `default`                                       |
+| `backend-operator.global.accountTokenSecret`                          | Secret name containing backend operator authentication token  | `backend-operator-token`                        |
+| `backend-operator.global.loginMethod`                                 | Authentication method for backend operator                    | `token`                                         |
+| `backend-operator.services.backendListener.imagePullPolicy`           | Kubernetes image pull policy for the backend listener service | `IfNotPresent`                                  |
+| `backend-operator.services.backendListener.initContainers`            | Init containers for backend listener service                  | Wait for gateway and backend-operator-token     |
+| `backend-operator.services.backendListener.resources.requests.cpu`    | CPU resource requests for backend listener container          | `"125m"`                                        |
+| `backend-operator.services.backendListener.resources.requests.memory` | Memory resource requests for backend listener container       | `"128Mi"`                                       |
+| `backend-operator.services.backendListener.resources.limits.cpu`      | CPU resource limits for backend listener container            | `"250m"`                                        |
+| `backend-operator.services.backendListener.resources.limits.memory`   | Memory resource limits for backend listener container         | `"256Mi"`                                       |
+| `backend-operator.services.backendWorker.imagePullPolicy`             | Kubernetes image pull policy for the backend worker service   | `IfNotPresent`                                  |
+| `backend-operator.services.backendWorker.initContainers`              | Init containers for backend worker service                    | Wait for gateway and backend-operator-token     |
+| `backend-operator.services.backendWorker.resources.requests.cpu`      | CPU resource requests for backend worker container            | `"125m"`                                        |
+| `backend-operator.services.backendWorker.resources.requests.memory`   | Memory resource requests for backend worker container         | `"128Mi"`                                       |
+| `backend-operator.services.backendWorker.resources.limits.cpu`        | CPU resource limits for backend worker container              | `"250m"`                                        |
+| `backend-operator.services.backendWorker.resources.limits.memory`     | Memory resource limits for backend worker container           | `"256Mi"`                                       |
+| `backend-operator.backendTestRunner.enabled`                          | Enable backend test runner                                    | `false`                                         |
+| `backend-operator.podMonitor.enabled`                                 | Enable PodMonitor for Prometheus scraping (requires `monitoring.coreos.com` CRD) | `false`                  |
diff --git a/deployments/charts/quick-start/templates/NOTES.txt b/deployments/charts/quick-start/templates/NOTES.txt
index 172260ef0..35d290814 100644
--- a/deployments/charts/quick-start/templates/NOTES.txt
+++ b/deployments/charts/quick-start/templates/NOTES.txt
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/deployments/charts/quick-start/templates/backend-operator-token-secret.yaml b/deployments/charts/quick-start/templates/backend-operator-token-secret.yaml
index 5e93b2af5..836c10870 100644
--- a/deployments/charts/quick-start/templates/backend-operator-token-secret.yaml
+++ b/deployments/charts/quick-start/templates/backend-operator-token-secret.yaml
@@ -37,17 +37,17 @@ spec:
     spec:
       restartPolicy: OnFailure
       initContainers:
-      - name: wait-for-ingress
+      - name: wait-for-service
         image: busybox:1.37.0
         command:
         - sh
         - -c
         - |
-          until nc -z quick-start 80; do
-            echo "Waiting for quick-start..."
+          until nc -z osmo-service 80; do
+            echo "Waiting for osmo-service..."
             sleep 2
           done
-          echo "OSMO quick start ingress is ready"
+          echo "OSMO service is ready"
       containers:
       - name: token-generator
         image: alpine/k8s:1.28.4
@@ -59,7 +59,7 @@ spec:
 
           apk add --no-cache jq
 
-          BASE_URL="http://quick-start.osmo"
+          BASE_URL="http://osmo-service"
           echo "Using URL: $BASE_URL"
 
           echo "Checking if secret exists and testing token..."
diff --git a/deployments/charts/quick-start/templates/config-setup.yaml b/deployments/charts/quick-start/templates/config-setup.yaml
index e9c4df2bd..e7d3b4e56 100644
--- a/deployments/charts/quick-start/templates/config-setup.yaml
+++ b/deployments/charts/quick-start/templates/config-setup.yaml
@@ -23,17 +23,17 @@ spec:
     spec:
       restartPolicy: OnFailure
       initContainers:
-      - name: wait-for-ingress
+      - name: wait-for-gateway
         image: busybox:1.37.0
         command:
         - sh
         - -c
         - |
-          until nc -z quick-start 80; do
-            echo "Waiting for quick-start..."
+          until nc -z {{ .Values.service.gateway.name | default "osmo-gateway" }} 80; do
+            echo "Waiting for {{ .Values.service.gateway.name | default "osmo-gateway" }}..."
             sleep 2
           done
-          echo "OSMO quick start ingress is ready"
+          echo "OSMO gateway is ready"
       containers:
       - name: config-setup
         image: alpine/curl:8.14.1
@@ -45,7 +45,7 @@ spec:
 
           apk add --no-cache jq
 
-          BASE_URL="http://quick-start.osmo"
+          BASE_URL="http://{{ .Values.service.gateway.name | default "osmo-gateway" }}.{{ .Release.Namespace }}.svc.cluster.local"
           echo "Using URL: $BASE_URL"
 
           echo "Configuring OSMO settings..."
@@ -222,20 +222,6 @@ spec:
           done
           echo "Backend default is now available"
 
-          echo "Configuring backend settings..."
-
-          # Update backend configuration (POST /api/configs/backend/default)
-          curl -s -X POST \
-            -H "Content-Type: application/json" \
-            -H "x-osmo-user: testuser" \
-            "$BASE_URL/api/configs/backend/default" \
-            -d '{
-              "configs": {
-                "router_address": "ws://quick-start.osmo"
-              },
-              "description": "Update default backend config"
-            }'
-
           echo "Setting default pool..."
 
           # Set default pool (POST /api/profile/settings)
diff --git a/deployments/charts/quick-start/values.yaml b/deployments/charts/quick-start/values.yaml
index 8d410b193..2c0e6dfc5 100644
--- a/deployments/charts/quick-start/values.yaml
+++ b/deployments/charts/quick-start/values.yaml
@@ -70,56 +70,35 @@ global:
     ##
     region: "us-east-1"
 
-## Ingress NGINX Controller configuration
+## OSMO main service configuration
 ##
-ingress-nginx:
-  ## Override the full name of the ingress-nginx resources
-  ##
-  fullnameOverride: quick-start
-  ## Controller configuration for traffic routing
+service:
+  ## Gateway configuration — routes all external traffic through Envoy
   ##
-  controller:
-    ## Set controller name to empty string to remove the -controller suffix
+  gateway:
+    ## Name the gateway service "quick-start" so that http://quick-start.osmo
+    ## resolves to the gateway via /etc/hosts + KIND port mapping.
     ##
-    name: ""
-    ## Node selector constraints for ingress controller pod scheduling
-    ##
-    nodeSelector:
-      ## Schedule ingress controller on service nodes
+    name: quick-start
+    envoy:
+      ## Scale to 1 replica for local development
       ##
-      node_group: ingress
-    ## Service configuration for ingress controller
-    ##
-    service:
-      ## Service type for ingress controller (NodePort for local access)
-      ##
-      type: NodePort
-      ## NodePort configuration for external access
-      ##
-      nodePorts:
-        ## HTTP port for external access to ingress controller
-        ##
-        http: 30080
-    ## Init containers for ingress controller
-    ##
-    ## Wait for the web UI to be up before starting ingress controller
-    ##
-    extraInitContainers:
-    - name: wait-for-web-ui
-      image: busybox:1.37.0
-      command:
-      - sh
-      - -c
-      - |
-        until nc -z osmo-ui 80; do
-          echo "Waiting for web-ui..."
-          sleep 2
-        done
-        echo "Web UI is ready"
+      scaling:
+        minReplicas: 1
+        maxReplicas: 1
+      ## NodePort for KIND — maps host port 80 to gateway via KIND extraPortMappings
+      ##
+      service:
+        type: NodePort
+        nodePort: 30080
+        httpsPort: null
+    ## Disable auth components for local development
+    ##
+    oauth2Proxy:
+      enabled: false
+    authz:
+      enabled: false
 
-## OSMO main service configuration
-##
-service:
   ## Configuration for individual OSMO services
   ##
   services:
@@ -204,7 +183,7 @@ service:
     ## Main API service configuration
     ##
     service:
-      ## Hostname for the OSMO service ingress
+      ## Hostname for the OSMO service
       ##
       hostname: quick-start.osmo
       ## Kubernetes image pull policy for the API service
@@ -219,12 +198,6 @@ service:
         ## Maximum number of API service replicas
         ##
         maxReplicas: 1
-      ## Ingress configuration for external access to the API service
-      ##
-      ingress:
-        ## Enable SSL/TLS encryption for the ingress
-        ##
-        sslEnabled: false
       ## Init containers for API service
       ##
       ## Wait for data infra to be up before starting service
@@ -540,15 +513,12 @@ web-ui:
       ## Skip authentication for UI service
       ##
       skipAuth: true
-      ## Hostname for the UI service ingress
+      ## Hostname for the UI service
       ##
       hostname: quick-start.osmo
-      ## Ingress configuration for external access to the UI service
+      ## API hostname — point at the gateway for server-side rendering
       ##
-      ingress:
-        ## Enable SSL/TLS encryption for the ingress
-        ##
-        sslEnabled: false
+      apiHostname: quick-start.osmo.svc.cluster.local:80
 
 ## Router service configuration
 ##
@@ -569,7 +539,7 @@ router:
     ## Main router service configuration
     ##
     service:
-      ## Hostname for the router service ingress
+      ## Hostname for the router service
       ##
       hostname: quick-start.osmo
       ## Kubernetes image pull policy for the router service
@@ -584,12 +554,6 @@ router:
         ## Maximum number of router service replicas
         ##
         maxReplicas: 1
-      ## Ingress configuration for external access to the router service
-      ##
-      ingress:
-        ## Enable SSL/TLS encryption for the ingress
-        ##
-        sslEnabled: false
       ## Init containers for router service
       ##
       ## Wait for data infra to be up before starting service
@@ -633,7 +597,7 @@ backend-operator:
   global:
     ## OSMO service URL for backend operator communication
     ##
-    serviceUrl: http://quick-start.osmo
+    serviceUrl: http://quick-start.osmo.svc.cluster.local
     ## Kubernetes namespace for backend operator
     ##
     agentNamespace: osmo
@@ -664,10 +628,10 @@ backend-operator:
       imagePullPolicy: IfNotPresent
       ## Init containers for backend listener service
       ##
-      ## Wait for the agent service to be up before starting backend listener
+      ## Wait for the gateway to be up before starting backend listener
       ##
       initContainers:
-      - name: wait-for-ingress
+      - name: wait-for-gateway
         image: busybox:1.37.0
         command:
         - sh
@@ -677,7 +641,7 @@ backend-operator:
             echo "Waiting for quick-start..."
             sleep 2
           done
-          echo "OSMO quick start ingress is ready"
+          echo "OSMO gateway is ready"
       - name: wait-for-token
         image: alpine:3.18
         command:
@@ -689,7 +653,7 @@ backend-operator:
           set -e
           apk add --no-cache curl jq
           echo "Waiting for backend-operator-token to be created..."
-          until curl -s http://quick-start.osmo/api/auth/user/backend-operator/access_token | jq -e '.[] | select(.token_name == "backend-operator-token")' >/dev/null 2>&1; do
+          until curl -s http://quick-start/api/auth/user/backend-operator/access_token | jq -e '.[] | select(.token_name == "backend-operator-token")' >/dev/null 2>&1; do
             echo "Token backend-operator-token not found, waiting..."
             sleep 2
           done
@@ -715,10 +679,10 @@ backend-operator:
       imagePullPolicy: IfNotPresent
       ## Init containers for backend worker service
       ##
-      ## Wait for the agent service to be up before starting backend worker
+      ## Wait for the gateway to be up before starting backend worker
       ##
       initContainers:
-      - name: wait-for-ingress
+      - name: wait-for-gateway
         image: busybox:1.37.0
         command:
         - sh
@@ -728,7 +692,7 @@ backend-operator:
             echo "Waiting for quick-start..."
             sleep 2
           done
-          echo "OSMO quick start ingress is ready"
+          echo "OSMO gateway is ready"
       - name: wait-for-token
         image: alpine:3.18
         command:
@@ -740,7 +704,7 @@ backend-operator:
           set -e
           apk add --no-cache curl jq
           echo "Waiting for backend-operator-token to be created..."
-          until curl -s http://quick-start.osmo/api/auth/user/backend-operator/access_token | jq -e '.[] | select(.token_name == "backend-operator-token")' >/dev/null 2>&1; do
+          until curl -s http://quick-start/api/auth/user/backend-operator/access_token | jq -e '.[] | select(.token_name == "backend-operator-token")' >/dev/null 2>&1; do
             echo "Token backend-operator-token not found, waiting..."
             sleep 2
           done
@@ -770,4 +734,3 @@ backend-operator:
     ## Enable backend test runner
     ##
     enabled: false
-
diff --git a/deployments/charts/router/templates/NOTES.txt b/deployments/charts/router/templates/NOTES.txt
index 198aa4645..619a71ad1 100644
--- a/deployments/charts/router/templates/NOTES.txt
+++ b/deployments/charts/router/templates/NOTES.txt
@@ -1,19 +1,5 @@
-1. Get the application URL by running these commands:
-{{- if .Values.services.service.ingress.sslEnabled }}
-  https://{{ .Values.services.service.hostname }}{{ .Values.services.service.ingress.prefix }}api/router
-{{- else }}
-  http://{{ .Values.services.service.hostname }}{{ .Values.services.service.ingress.prefix }}api/router
-{{- end }}
-
-2. The router service is available at:
+1. The router service is available at:
   kubectl get service {{ .Values.services.service.serviceName }}
 
-3. Check the deployment status:
+2. Check the deployment status:
   kubectl get deployment {{ .Values.services.service.serviceName }}
-
-{{- if .Values.services.service.ingress.sslEnabled }}
-
-4. Create a TLS secret for OSMO if not using ALB annotations:
-  kubectl create secret tls {{ .Values.services.service.ingress.sslSecret }} --key ${KEY_FILE} --cert ${CERT_FILE}
-
-{{- end }}
diff --git a/deployments/charts/router/templates/router-service.yaml b/deployments/charts/router/templates/router-service.yaml
index 064a600eb..4b861dc9d 100644
--- a/deployments/charts/router/templates/router-service.yaml
+++ b/deployments/charts/router/templates/router-service.yaml
@@ -255,61 +255,6 @@ spec:
   selector:
     app: {{ .Values.services.service.serviceName }}
 
-{{- if .Values.services.service.ingress.enabled }}
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Values.services.service.serviceName }}
-  annotations:
-    {{- if .Values.services.service.ingress.albAnnotations.enabled}}
-    alb.ingress.kubernetes.io/group.name: osmo
-    alb.ingress.kubernetes.io/group.order: "50"
-    alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/certificate-arn: {{ .Values.services.service.ingress.albAnnotations.sslCertArn }}
-    {{- if .Values.services.service.webserverEnabled }}
-    alb.ingress.kubernetes.io/hostnames: '["*.{{ .Values.services.service.hostname }}", "{{ .Values.services.service.hostname }}"]'
-    {{- end }}
-    {{- end }}
-    {{- range $k, $v := .Values.services.service.ingress.annotations }}
-    {{$k}}: {{ $v | quote }}
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.services.service.ingress.ingressClass }}
-  rules:
-  {{- if .Values.services.service.webserverEnabled }}
-  - host: "*.{{ .Values.services.service.hostname }}"
-    http:
-      paths:
-      - path: {{ .Values.services.service.ingress.prefix }}
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.service.serviceName }}
-            port:
-              number: 80
-  {{- end }}
-  - host: {{ .Values.services.service.hostname }}
-    http:
-      paths:
-      - path: {{ .Values.services.service.ingress.prefix }}api/router
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.service.serviceName }}
-            port:
-              number: 80
-  {{- if .Values.services.service.ingress.sslEnabled }}
-  tls:
-  - hosts:
-    - {{ .Values.services.service.hostname }}
-    {{- if .Values.services.service.webserverEnabled }}
-    - "*.{{ .Values.services.service.hostname }}"
-    {{- end }}
-    secretName: {{.Values.services.service.ingress.sslSecret }}
-  {{- end }}
-{{- end }}
 ---
 
 apiVersion: autoscaling/v2
diff --git a/deployments/charts/router/values.yaml b/deployments/charts/router/values.yaml
index c21be0388..4e56f01a3 100644
--- a/deployments/charts/router/values.yaml
+++ b/deployments/charts/router/values.yaml
@@ -154,46 +154,6 @@ services:
     #   - "example.local"
 
 
-    ## Ingress configuration for external access to the router service
-    ##
-    ingress:
-      ## Enable ingress for external access
-      ##
-      enabled: true
-
-      ## URL path prefix for all ingress rules
-      ##
-      prefix: /
-
-      ## Ingress controller class to use for routing traffic
-      ##
-      ingressClass: nginx
-
-      ## AWS Application Load Balancer (ALB) specific annotations
-      ##
-      albAnnotations:
-        ## Enable ALB-specific annotations in the ingress
-        ##
-        enabled: false
-
-        ## ARN of the SSL certificate for HTTPS traffic
-        ##
-        sslCertArn: arn:aws:acm:us-west-2:XXXXXXXXX:certificate/YYYYYYYY
-
-      ## Enable SSL/TLS encryption for the ingress
-      ##
-      sslEnabled: true
-
-      ## Name of the Kubernetes secret containing SSL/TLS certificates
-      ##
-      sslSecret: osmo-tls
-
-      ## Additional custom annotations for the ingress resource
-      ##
-      annotations: {}
-      # nginx.ingress.kubernetes.io/proxy-body-size: "100m"
-      # alb.ingress.kubernetes.io/target-type: ip
-
     ## Node selector constraints for router pod scheduling
     ## Leave empty to allow scheduling on any node
     ##
diff --git a/deployments/charts/service/templates/_gateway-envoy-config.tpl b/deployments/charts/service/templates/_gateway-envoy-config.tpl
index 142b7410d..01933feac 100644
--- a/deployments/charts/service/templates/_gateway-envoy-config.tpl
+++ b/deployments/charts/service/templates/_gateway-envoy-config.tpl
@@ -29,7 +29,7 @@ setting detects this rotation and triggers Envoy to reload.
 {{- $gw := .Values.gateway }}
 {{- $envoy := $gw.envoy }}
 {{- $gwName := include "osmo.gateway-name" . }}
-{{- if and $gw.enabled $envoy.enabled }}
+{{- if $envoy.enabled }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/deployments/charts/service/templates/agent-service.yaml b/deployments/charts/service/templates/agent-service.yaml
index 993fcd183..eb44bbce0 100644
--- a/deployments/charts/service/templates/agent-service.yaml
+++ b/deployments/charts/service/templates/agent-service.yaml
@@ -235,43 +235,6 @@ spec:
   selector:
     app: {{ .Values.services.agent.serviceName }}
 
-{{- if .Values.services.service.ingress.enabled }}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Values.services.agent.serviceName }}
-  annotations:
-    {{- if .Values.services.service.ingress.albAnnotations.enabled}}
-    alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/group.name: osmo
-    alb.ingress.kubernetes.io/group.order: "50"
-    alb.ingress.kubernetes.io/certificate-arn: {{ .Values.services.service.ingress.albAnnotations.sslCertArn }}
-    {{- end }}
-    {{- range $k, $v := .Values.services.service.ingress.annotations }}
-    {{$k}}: {{ $v | quote }}
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.services.service.ingress.ingressClass }}
-  rules:
-  - host: {{ .Values.services.service.hostname }}
-    http:
-      paths:
-      - path: {{ .Values.services.service.ingress.prefix }}api/agent
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.agent.serviceName }}
-            port:
-              number: 80
-  {{- if .Values.services.service.ingress.sslEnabled }}
-  tls:
-  - hosts:
-    - {{ .Values.services.service.hostname }}
-    secretName: {{.Values.services.service.ingress.sslSecret }}
-  {{- end }}
-{{- end }}
-
 ---
 
 apiVersion: autoscaling/v2
diff --git a/deployments/charts/service/templates/api-service.yaml b/deployments/charts/service/templates/api-service.yaml
index 3b55cdab1..9239be801 100644
--- a/deployments/charts/service/templates/api-service.yaml
+++ b/deployments/charts/service/templates/api-service.yaml
@@ -264,52 +264,6 @@ spec:
   selector:
     app: {{ .Values.services.service.serviceName }}
 
-{{- if .Values.services.service.ingress.enabled }}
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Values.services.service.serviceName }}
-  annotations:
-
-    {{- if .Values.services.service.ingress.albAnnotations.enabled}}
-    alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/group.name: osmo
-    alb.ingress.kubernetes.io/group.order: "100"
-    alb.ingress.kubernetes.io/certificate-arn: {{ .Values.services.service.ingress.albAnnotations.sslCertArn }}
-    {{- end }}
-    {{- range $k, $v := .Values.services.service.ingress.annotations }}
-    {{$k}}: {{ $v | quote }}
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.services.service.ingress.ingressClass }}
-  rules:
-  - host: {{ .Values.services.service.hostname }}
-    http:
-      paths:
-      - path: {{ .Values.services.service.ingress.prefix }}api
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.service.serviceName }}
-            port:
-              number: 80
-      - path: {{ .Values.services.service.ingress.prefix }}client
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.service.serviceName }}
-            port:
-              number: 80
-  {{- if .Values.services.service.ingress.sslEnabled }}
-  tls:
-  - hosts:
-    - {{ .Values.services.service.hostname }}
-    secretName: {{.Values.services.service.ingress.sslSecret }}
-  {{- end }}
-{{- end }}
-
 ---
 
 apiVersion: autoscaling/v2
diff --git a/deployments/charts/service/templates/gateway.yaml b/deployments/charts/service/templates/gateway.yaml
index 2a9cf52b0..2da6fe17f 100644
--- a/deployments/charts/service/templates/gateway.yaml
+++ b/deployments/charts/service/templates/gateway.yaml
@@ -14,15 +14,9 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-{{- if .Values.gateway.enabled }}
 {{- $gw := .Values.gateway }}
 {{- $gwName := include "osmo.gateway-name" . }}
 
-{{/* Validate required fields */}}
-{{- if and $gw.oauth2Proxy.enabled (not $gw.envoy.hostname) }}
-  {{- fail "gateway.envoy.hostname is required when gateway.oauth2Proxy.enabled is true (used for the OAuth2 redirect URL)" }}
-{{- end }}
-
 {{/* ================================================================ */}}
 {{/* Envoy ConfigMap (dynamic LDS/CDS)                                */}}
 {{/* ================================================================ */}}
@@ -135,26 +129,46 @@ spec:
 
 {{/* ================================================================ */}}
 {{/* Envoy Service                                                    */}}
+{{/*                                                                  */}}
+{{/* Service type controls external access:                           */}}
+{{/*   LoadBalancer (default) — NLB for direct external access        */}}
+{{/*   ClusterIP — use with gateway.envoy.ingress for shared ALB      */}}
 {{/* ================================================================ */}}
 apiVersion: v1
 kind: Service
 metadata:
   name: {{ $gwName }}
+  {{- with $gw.envoy.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
+  type: {{ $gw.envoy.service.type | default "LoadBalancer" }}
   ports:
     - port: 80
       targetPort: envoy-http
       protocol: TCP
       name: http
+      {{- if $gw.envoy.service.nodePort }}
+      nodePort: {{ $gw.envoy.service.nodePort }}
+      {{- end }}
+    {{- if $gw.envoy.service.httpsPort }}
+    - port: {{ $gw.envoy.service.httpsPort }}
+      targetPort: envoy-http
+      protocol: TCP
+      name: https
+    {{- end }}
   selector:
     {{- include "osmo.gateway-component-labels" (dict "component" "envoy" "context" .) | nindent 4 }}
 
+{{- if $gw.envoy.ingress.enabled }}
 ---
 
 {{/* ================================================================ */}}
-{{/* Envoy Ingress                                                    */}}
+{{/* Envoy Ingress — use when multiple namespaces share a single      */}}
+{{/* load balancer (e.g. ALB with group.name). Set service type to    */}}
+{{/* ClusterIP and enable this to route external traffic via ALB.      */}}
 {{/* ================================================================ */}}
-{{- if $gw.envoy.ingress.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -162,15 +176,9 @@ metadata:
   annotations:
     {{- if $gw.envoy.ingress.albAnnotations.enabled }}
     alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/group.name: osmo
-    alb.ingress.kubernetes.io/group.order: "10"
+    alb.ingress.kubernetes.io/group.name: {{ $gw.envoy.ingress.albAnnotations.groupName | default "osmo" }}
+    alb.ingress.kubernetes.io/group.order: {{ $gw.envoy.ingress.albAnnotations.groupOrder | default "10" | quote }}
     alb.ingress.kubernetes.io/certificate-arn: {{ $gw.envoy.ingress.albAnnotations.sslCertArn }}
-    {{- if $gw.envoy.ssl.enabled }}
-    alb.ingress.kubernetes.io/backend-protocol: HTTPS
-    {{- end }}
-    {{- end }}
-    {{- if $gw.envoy.ssl.enabled }}
-    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
     {{- end }}
     {{- range $k, $v := $gw.envoy.ingress.annotations }}
     {{ $k }}: {{ $v | quote }}
@@ -693,4 +701,3 @@ spec:
 {{- end }}
 {{- end }}
 
-{{- end }}{{/* end gateway.enabled */}}
diff --git a/deployments/charts/service/templates/logger-service.yaml b/deployments/charts/service/templates/logger-service.yaml
index fc97acc57..ef7c1c387 100644
--- a/deployments/charts/service/templates/logger-service.yaml
+++ b/deployments/charts/service/templates/logger-service.yaml
@@ -227,43 +227,6 @@ spec:
   selector:
     app: {{ .Values.services.logger.serviceName }}
 
-{{- if .Values.services.service.ingress.enabled }}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Values.services.logger.serviceName }}
-  annotations:
-    {{- if .Values.services.service.ingress.albAnnotations.enabled}}
-    alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/group.name: osmo
-    alb.ingress.kubernetes.io/group.order: "50"
-    alb.ingress.kubernetes.io/certificate-arn: {{ .Values.services.service.ingress.albAnnotations.sslCertArn }}
-    {{- end }}
-    {{- range $k, $v := .Values.services.service.ingress.annotations }}
-    {{$k}}: {{ $v | quote }}
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.services.service.ingress.ingressClass }}
-  rules:
-  - host: {{ .Values.services.service.hostname }}
-    http:
-      paths:
-      - path: {{ .Values.services.service.ingress.prefix }}api/logger
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.logger.serviceName }}
-            port:
-              number: 80
-  {{- if .Values.services.service.ingress.sslEnabled }}
-  tls:
-  - hosts:
-    - {{ .Values.services.service.hostname }}
-    secretName: {{.Values.services.service.ingress.sslSecret }}
-  {{- end }}
-{{- end }}
-
 ---
 
 apiVersion: autoscaling/v2
diff --git a/deployments/charts/service/values.yaml b/deployments/charts/service/values.yaml
index 88242983b..78c07e93d 100644
--- a/deployments/charts/service/values.yaml
+++ b/deployments/charts/service/values.yaml
@@ -669,46 +669,6 @@ services:
       ##
       logout_endpoint: ""
 
-    ## Ingress configuration for external access to the API service
-    ##
-    ingress:
-      ## Enable ingress for external access
-      ##
-      enabled: true
-
-      ## URL path prefix for all ingress rules
-      ##
-      prefix: /
-
-      ## Ingress controller class to use for routing traffic
-      ##
-      ingressClass: nginx
-
-      ## AWS Application Load Balancer (ALB) specific annotations
-      ##
-      albAnnotations:
-        ## Enable ALB-specific annotations in the ingress
-        ##
-        enabled: false
-
-        ## ARN of the SSL certificate for HTTPS traffic
-        ##
-        sslCertArn: arn:aws:acm:us-west-2:XXXXXXXXX:certificate/YYYYYYYY
-
-      ## Enable SSL/TLS encryption for the ingress
-      ##
-      sslEnabled: true
-
-      ## Name of the Kubernetes secret containing SSL/TLS certificates
-      ##
-      sslSecret: osmo-tls
-
-      ## Additional custom annotations for the ingress resource
-      ##
-      annotations: {}
-      # nginx.ingress.kubernetes.io/proxy-body-size: "100m"
-      # alb.ingress.kubernetes.io/target-type: ip
-
     ## Liveness probe configuration for the API service
     ##
     livenessProbe:
@@ -1052,10 +1012,6 @@ extraConfigMaps: []
 ## is updated — no pod restart required.
 ## ============================================================================
 gateway:
-  ## Enable the standalone gateway deployment
-  ##
-  enabled: false
-
   ## Name prefix for all gateway K8s resources (e.g. osmo-gateway-envoy)
   ##
   name: osmo-gateway
@@ -1119,16 +1075,67 @@ gateway:
     ##
     serviceAccountName: ""
 
-    ## Ingress configuration for the gateway
+    ## Kubernetes Service configuration for the gateway.
+    ##
+    ## Two modes for external access:
+    ##   NLB (default): type=LoadBalancer — each deployment gets its own NLB
+    ##   ALB (shared):  type=ClusterIP + ingress.enabled=true — multiple
+    ##                  namespaces share a single ALB via group.name
+    ##
+    service:
+      ## Service type:
+      ##   LoadBalancer — direct NLB access (default, one LB per deployment)
+      ##   ClusterIP    — use with gateway.envoy.ingress for shared ALB
+      ##   NodePort     — use with KIND port mapping for local development
+      ##
+      type: LoadBalancer
+
+      ## HTTPS port for NLB TLS termination.
+      ## The NLB terminates TLS on this port and forwards plaintext to Envoy.
+      ## Set to null to expose only port 80 (e.g. for local development).
+      ##
+      httpsPort: 443
+
+      ## Fixed NodePort for the HTTP port (only used when type=NodePort).
+      ## KIND maps this to a host port for local access.
+      ##
+      nodePort: null
+
+      ## Annotations for the Service (e.g. AWS NLB annotations)
+      ##
+      annotations: {}
+
+    ## Ingress configuration for shared ALB mode.
+    ## Enable this and set service.type=ClusterIP when multiple namespaces
+    ## need to share a single load balancer (e.g. ALB with group.name).
     ##
     ingress:
+      ## Enable ALB Ingress (set service.type to ClusterIP when using this)
+      ##
       enabled: false
+
+      ## Ingress controller class
+      ##
       ingressClass: alb
+
+      ## AWS ALB-specific annotations
+      ##
       albAnnotations:
         enabled: false
+        groupName: osmo
+        groupOrder: "10"
         sslCertArn: ""
+
+      ## Enable TLS on the Ingress
+      ##
       sslEnabled: false
+
+      ## Secret name for TLS certificates
+      ##
       sslSecret: osmo-tls
+
+      ## Additional annotations
+      ##
       annotations: {}
 
     ## SSL/TLS configuration for the Envoy listener (downstream).
diff --git a/deployments/charts/web-ui/templates/NOTES.txt b/deployments/charts/web-ui/templates/NOTES.txt
index b85cd059a..f73e1f945 100644
--- a/deployments/charts/web-ui/templates/NOTES.txt
+++ b/deployments/charts/web-ui/templates/NOTES.txt
@@ -1,8 +1,6 @@
-1. Get the application URL by running these commands:
-{{- if .Values.services.ui.ingress.sslEnabled }}
-  https://{{ .Values.services.ui.hostname }}{{ .Values.services.ui.ingress.prefix }}
-{{- else }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ .Values.services.ui.serviceName }}" -o jsonpath="{.items[0].metadata.name}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ .Values.services.ui.containerPort }}
-{{- end }}
+1. The UI service is available at:
+  kubectl get service {{ .Values.services.ui.serviceName }}
+
+2. To access the UI locally:
+  kubectl port-forward svc/{{ .Values.services.ui.serviceName }} 8080:80
+  Visit http://localhost:8080
diff --git a/deployments/charts/web-ui/templates/ui.yaml b/deployments/charts/web-ui/templates/ui.yaml
index 9bc5288fb..f9544bf5b 100644
--- a/deployments/charts/web-ui/templates/ui.yaml
+++ b/deployments/charts/web-ui/templates/ui.yaml
@@ -291,43 +291,6 @@ spec:
       {{- toYaml . | nindent 4 }}
     {{- end }}
 
-{{ if .Values.services.ui.ingress.enabled }}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Values.services.ui.serviceName }}
-  annotations:
-    {{- if .Values.services.ui.ingress.albAnnotations.enabled}}
-    alb.ingress.kubernetes.io/target-type: ip
-    alb.ingress.kubernetes.io/group.name: osmo
-    alb.ingress.kubernetes.io/group.order: "200"
-    alb.ingress.kubernetes.io/certificate-arn: {{ .Values.services.ui.ingress.albAnnotations.sslCertArn }}
-    {{- end }}
-    {{- range $k, $v := .Values.services.ui.ingress.annotations }}
-    {{$k}}: {{ $v | quote }}
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.services.ui.ingress.ingressClass }}
-  rules:
-  - host: {{ .Values.services.ui.hostname }}
-    http:
-      paths:
-      - path: {{ .Values.services.ui.ingress.prefix }}
-        pathType: Prefix
-        backend:
-          service:
-            name: {{ .Values.services.ui.serviceName }}
-            port:
-              number: 80
-  {{- if .Values.services.ui.ingress.sslEnabled }}
-  tls:
-  - hosts:
-    - {{ .Values.services.ui.hostname }}
-    secretName: {{.Values.services.ui.ingress.sslSecret }}
-  {{- end }}
-{{- end }}
-
 {{- if .Values.services.ui.scaling.enabled }}
 ---
 apiVersion: autoscaling/v2
diff --git a/deployments/charts/web-ui/values.yaml b/deployments/charts/web-ui/values.yaml
index 328d759cb..555a83d2a 100644
--- a/deployments/charts/web-ui/values.yaml
+++ b/deployments/charts/web-ui/values.yaml
@@ -75,14 +75,13 @@ services:
     ##
     hostname: ""
 
-    ## Hostname on which the osmo API server is hosted
-    ## Default is the local cluster hostname
-    ## Can be overridden to serve the API from public domain
-    ## When using the gateway, point this at the gateway service so that
-    ## server-side API calls go through Envoy's auth filters.
-    ## e.g. "osmo-gateway.your-domain.com"
+    ## Internal hostname for server-side rendering (SSR) API calls.
+    ## Used only by the Next.js server process (not the browser).
+    ## Must point at the gateway so SSR requests go through Envoy's auth filters.
+    ## Browser API calls use window.location.host automatically.
+    ## Override with FQDN for cross-namespace deployments.
     ##
-    apiHostname: "osmo-service.your-domain.com"
+    apiHostname: "osmo-gateway:80"
 
     ## Enable port-forwarding through Web UI
     ##
@@ -197,46 +196,6 @@ services:
       selector: {}
       # version: v1.0.0
 
-    ## Ingress configuration for external access to the UI service
-    ##
-    ingress:
-      ## Enable ingress for the UI service
-      ##
-      enabled: true
-
-      ## URL path prefix for all ingress rules
-      ##
-      prefix: /
-
-      ## Ingress controller class to use for routing traffic
-      ##
-      ingressClass: nginx
-
-      ## AWS Application Load Balancer (ALB) specific annotations
-      ##
-      albAnnotations:
-        ## Enable ALB-specific annotations in the ingress
-        ##
-        enabled: false
-
-        ## ARN of the SSL certificate for HTTPS traffic
-        ##
-        sslCertArn: arn:aws:acm:us-west-2:XXXXXXXXX:certificate/YYYYYYYY
-
-      ## Enable SSL/TLS encryption for the ingress
-      ##
-      sslEnabled: true
-
-      ## Name of the Kubernetes secret containing SSL/TLS certificates
-      ##
-      sslSecret: osmo-tls
-
-      ## Additional custom annotations for the ingress resource
-      ##
-      annotations: {}
-      # nginx.ingress.kubernetes.io/proxy-body-size: "100m"
-      # nginx.ingress.kubernetes.io/rate-limit-requests-per-second: "10"
-
     ## Node selector constraints for UI pod scheduling
     ## Leave empty to allow scheduling on any node
     ##
diff --git a/docs/deployment_guide/appendix/deploy_local.rst b/docs/deployment_guide/appendix/deploy_local.rst
index 762a2ead0..d08bb7e58 100644
--- a/docs/deployment_guide/appendix/deploy_local.rst
+++ b/docs/deployment_guide/appendix/deploy_local.rst
@@ -95,17 +95,6 @@ Install `nvkind <https://github.com/NVIDIA/nvkind>`_ by following the `prerequis
     name: osmo
     nodes:
       - role: control-plane
-      - role: worker
-        kubeadmConfigPatches:
-        - |
-          kind: JoinConfiguration
-          nodeRegistration:
-            kubeletExtraArgs:
-              node-labels: "node_group=ingress,nvidia.com/gpu.deploy.operands=false"
-        extraPortMappings:
-          - containerPort: 30080
-            hostPort: 80
-            protocol: TCP
       - role: worker
         kubeadmConfigPatches:
         - |
@@ -130,6 +119,10 @@ Install `nvkind <https://github.com/NVIDIA/nvkind>`_ by following the `prerequis
           nodeRegistration:
             kubeletExtraArgs:
               node-labels: "node_group=service,nvidia.com/gpu.deploy.operands=false"
+        extraPortMappings:
+          - containerPort: 30080
+            hostPort: 80
+            protocol: TCP
       - role: worker
         kubeadmConfigPatches:
         - |
@@ -190,17 +183,6 @@ If your workstation does not have a GPU, follow these steps for a standard CPU-o
     name: osmo
     nodes:
       - role: control-plane
-      - role: worker
-        kubeadmConfigPatches:
-        - |
-          kind: JoinConfiguration
-          nodeRegistration:
-            kubeletExtraArgs:
-              node-labels: "node_group=ingress"
-        extraPortMappings:
-          - containerPort: 30080
-            hostPort: 80
-            protocol: TCP
       - role: worker
         kubeadmConfigPatches:
         - |
@@ -225,6 +207,10 @@ If your workstation does not have a GPU, follow these steps for a standard CPU-o
           nodeRegistration:
             kubeletExtraArgs:
               node-labels: "node_group=service"
+        extraPortMappings:
+          - containerPort: 30080
+            hostPort: 80
+            protocol: TCP
       - role: worker
         kubeadmConfigPatches:
         - |
@@ -253,8 +239,7 @@ Both commands create a Kubernetes cluster on your workstation with a control pla
 
 **Control Plane**
 
-* 2 worker nodes labeled ``node_group=service`` for API server and workflow engine
-* 1 worker node labeled ``node_group=ingress`` for NGINX ingress
+* 2 worker nodes labeled ``node_group=service`` for API server, workflow engine, and gateway (Envoy)
 * 1 worker node labeled ``node_group=kai-scheduler`` for KAI scheduler
 
 **Compute Layer**
@@ -305,13 +290,13 @@ Deploy the complete OSMO platform with a single Helm command:
 Step 4: Configure Access
 =========================
 
-Add a host entry to access OSMO from your browser:
+Add an entry to /etc/hosts so your browser and CLI can reach OSMO by hostname:
 
 .. code-block:: bash
 
    $ echo "127.0.0.1 quick-start.osmo" | sudo tee -a /etc/hosts
 
-This allows you to visit ``http://quick-start.osmo`` in your web browser.
+The KIND cluster maps host port 80 to the gateway's NodePort, so OSMO is accessible at ``http://quick-start.osmo`` with no port-forward needed.
 
 Step 5: Install OSMO CLI
 =========================
diff --git a/docs/deployment_guide/appendix/deploy_minimal.rst b/docs/deployment_guide/appendix/deploy_minimal.rst
index 5bfb584b1..b5aec88e5 100644
--- a/docs/deployment_guide/appendix/deploy_minimal.rst
+++ b/docs/deployment_guide/appendix/deploy_minimal.rst
@@ -50,10 +50,6 @@ Prerequisites
 
 Refer to :ref:`prerequisites` for the setup of the Kubernetes cluster, PostgreSQL database, and Redis instance.
 
-.. note::
-
-  Ingress must be installed as part of networking setup to use exec or port forwarding features in OSMO workflows.
-
 Step 1: Create Namespace
 ========================
 
@@ -218,7 +214,7 @@ Create the following values files for the minimal deployment:
   :icon: file
 
   .. code-block:: yaml
-    :emphasize-lines: 2-3, 14, 17, 24
+    :emphasize-lines: 2-3, 14, 17
 
     global:
       osmoImageLocation: <insert-osmo-image-registry>
@@ -252,33 +248,6 @@ Create the following values files for the minimal deployment:
           minReplicas: 1
           maxReplicas: 1
 
-        # Set your domain for ingress if you want to enable ingress for external access
-        # hostname: <your-domain>
-        ingress:
-          enabled: false  # Set to true if you want to enable ingress for external access
-
-          # Example: Using alb as ingress
-          # ingress:
-          #   enabled: true
-          #   ingressClass: alb
-          #   sslEnabled: true
-          #   albAnnotations:
-          #     enabled: true
-          #     sslCertArn: <your-ssl-cert-arn>
-          #   annotations:
-          #     ## the alb scheme is used to specify the scheme of the ingress rule, internet-facing for public ALB and internal for private ALB
-          #     # alb.ingress.kubernetes.io/scheme: internet-facing
-
-          # Example: Using nginx as ingress
-          # ingress:
-          #   enabled: true
-          #   ingressClass: nginx
-          #   annotations:
-          #     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-          #     nginx.ingress.kubernetes.io/proxy-buffers: "8 16k"
-          #     nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
-          #     nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"
-
       agent:
         scaling:
           minReplicas: 1
@@ -300,6 +269,12 @@ Create the following values files for the minimal deployment:
         passwordSecretName: default-admin-secret
         passwordSecretKey: password
 
+    gateway:
+      oauth2Proxy:
+        enabled: false
+      authz:
+        enabled: false
+
 **UI Service Values** (``ui_values.yaml``):
 
 .. dropdown:: ``ui_values.yaml``
@@ -307,7 +282,7 @@ Create the following values files for the minimal deployment:
   :icon: file
 
   .. code-block:: yaml
-    :emphasize-lines: 2,3,8
+    :emphasize-lines: 2,3,7
 
     global:
       osmoImageLocation: <insert-osmo-image-registry>
@@ -315,35 +290,7 @@ Create the following values files for the minimal deployment:
 
     services:
       ui:
-        # Set your domain for UI ingress if you want to enable ingress for external access
-        # hostname: <your-domain>
-
-        apiHostname: osmo-service.osmo-minimal.svc.cluster.local:80 # update to your namespace if not using osmo-minimal namespace
-
-        ingress:
-          enabled: false  # Set to true if you want to enable ingress for external access
-
-        # Example: Using alb as ingress
-        # ingress:
-        #   enabled: true
-        #   ingressClass: alb
-        #   sslEnabled: true
-        #   albAnnotations:
-        #     enabled: true
-        #     sslCertArn: <your-ssl-cert-arn>
-        #   annotations:
-        #     ## the alb scheme is used to specify the scheme of the ingress rule, internet-facing for public ALB and internal for private ALB
-        #     # alb.ingress.kubernetes.io/scheme: internet-facing
-
-        # Example: Using nginx as ingress
-        # ingress:
-        #   enabled: true
-        #   ingressClass: nginx
-        #   annotations:
-        #     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-        #     nginx.ingress.kubernetes.io/proxy-buffers: "8 16k"
-        #     nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
-        #     nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"
+        apiHostname: osmo-gateway.osmo-minimal.svc.cluster.local:80 # update to your namespace if not using osmo-minimal namespace
 
 **Router Service Values** (``router_values.yaml``):
 
@@ -372,40 +319,11 @@ Create the following values files for the minimal deployment:
         scaling:
           minReplicas: 1
           maxReplicas: 1
-        # Set your domain for router ingress if you want to enable ingress for external access
-        # hostname: <your-domain>
-        ingress:
-          enabled: false  # Set to true if you want to enable ingress for external access
-
-          # Example: Using alb as ingress
-          # ingress:
-          #   enabled: true
-          #   ingressClass: alb
-          #   sslEnabled: true
-          #   albAnnotations:
-          #     enabled: true
-          #     sslCertArn: <your-ssl-cert-arn>
-          #   annotations:
-          #     ## the alb scheme is used to specify the scheme of the ingress rule, internet-facing for public ALB and internal for private ALB
-          #     # alb.ingress.kubernetes.io/scheme: internet-facing
-
-          # Example: Using nginx as ingress
-          # ingress:
-          #   enabled: true
-          #   ingressClass: nginx
-          #   annotations:
-          #     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-          #     nginx.ingress.kubernetes.io/proxy-buffers: "8 16k"
-          #     nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
-          #     nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"
 
 .. important::
 
    1. Replace ``<insert-osmo-image-tag>`` with the desired OSMO version you want to deploy
-   2. Replace ``<your-domain>`` with your domain name (e.g., ``osmo.example.com``) if you want to enable ingress for external access
-   3. Update the ``serviceName`` for postgres and redis to match your external services
-   4. Update ``ingressClass`` and ``ingress`` to match your cluster's ingress controller and ingress configuration
-   5. Ensure your DNS points to the ingress controller's load balancer if you want to enable ingress for external access
+   2. Update the ``serviceName`` for postgres and redis to match your external services
 
 Step 6: Helm Deploy
 ===============================
@@ -464,34 +382,13 @@ Step 7: Verify Deployment
 
       $ kubectl get services -n osmo-minimal
 
-3. Verify that ingress configuration is set up correctly:
-
-   .. note::
-
-      If you have enabled ingress for external access, you should see ingress resources similar to the following:
+3. Port forward the gateway to access the OSMO UI:
 
    .. code-block:: bash
 
-      $ kubectl get ingress -n osmo-minimal
-
-   You should see ingress resources similar to:
-
-   .. code-block:: text
+      $ kubectl port-forward service/osmo-gateway 9000:80 -n osmo-minimal
 
-      NAME                     CLASS   HOSTS              ADDRESS         PORTS   AGE
-      osmo-agent-ingress       nginx   <your-domain>      <lb-ip>         80      2m
-      osmo-service-ingress     nginx   <your-domain>      <lb-ip>         80      2m
-      osmo-logger-ingress      nginx   <your-domain>      <lb-ip>         80      2m
-      osmo-ui-ingress          nginx   <your-domain>      <lb-ip>         80      2m
-      osmo-router-ingress      nginx   <your-domain>      <lb-ip>         80      2m
-
-4. Port forward to access the OSMO UI:
-
-   .. code-block:: bash
-
-      $ kubectl port-forward service/osmo-ui 3000:80 -n osmo-minimal
-
-   Visit http://localhost:3000 in your web browser to access the OSMO UI dashboard as a guest user.
+   Visit http://localhost:9000 in your web browser to access the OSMO UI dashboard as a guest user.
 
 Step 8: Install Backend Operator
 ===================================
@@ -508,8 +405,7 @@ Step 8: Install Backend Operator
        global:
          osmoImageLocation: <insert-osmo-image-registry>
          osmoImageTag: <insert-osmo-image-tag>
-         # update to the actual service URL if you have enabled ingress for external access
-         serviceUrl: http://osmo-agent.osmo-minimal.svc.cluster.local
+         serviceUrl: http://osmo-gateway.osmo-minimal.svc.cluster.local
          agentNamespace: osmo-operator
          backendNamespace: osmo-workflows
          backendName: default
@@ -541,23 +437,15 @@ Step 8: Install Backend Operator
 
 2. Login to OSMO:
 
-
-   If ingress is disabled, you can port forward the OSMO API server and login to OSMO
+   Port forward the gateway and login to OSMO:
 
    .. code-block:: bash
 
-      $ kubectl port-forward service/osmo-service 9000:80 -n osmo-minimal
+      $ kubectl port-forward service/osmo-gateway 9000:80 -n osmo-minimal
 
       $ osmo login http://localhost:9000 --method=dev --username=testuser
 
 
-   If ingress is enabled, you can login to OSMO through your domain:
-
-   .. code-block:: bash
-
-      $ osmo login https://<your-domain> --method=dev --username=testuser
-
-
 3. Create the service account and token:
 
    Create a service account user and generate a token for the backend operator with OSMO CLI:
@@ -591,34 +479,15 @@ Step 8: Install Backend Operator
 Step 9: Access OSMO
 ====================
 
-With Ingress
--------------
-
-1. **Access OSMO Service API**:
-
-   Visit ``https://<your-domain>/api/docs`` in your web browser to access the OSMO API.
-
-2. **Access OSMO UI**:
+Port forward the gateway to access all OSMO services if you have not already:
 
-   Visit ``https://<your-domain>`` in your web browser to access the OSMO UI.
-
-.. note::
-   1. Replace ``<your-domain>`` with your domain name or use the alternative approach below
-   2. Ensure your DNS is configured to point to your ingress controller's load balancer
-   3. If you need to test without DNS setup, you can use port forwarding as an alternative as well
-
-Without Ingress
--------------------
+.. code-block:: bash
 
-If you haven't set up DNS yet, you can access OSMO using port forwarding as an alternative:
+   $ kubectl port-forward service/osmo-gateway 9000:80 -n osmo-minimal
 
 1. **Access OSMO Service API**:
 
-   .. code-block:: bash
-
-      $ kubectl port-forward service/osmo-service 9000:80 -n osmo-minimal
-
-   Then access the OSMO API at http://localhost:9000/api/docs in your web browser. You can interact with the API using the OSMO CLI.
+   Access the OSMO API at http://localhost:9000/api/docs in your web browser. You can interact with the API using the OSMO CLI.
 
    .. code-block:: bash
 
@@ -630,18 +499,9 @@ If you haven't set up DNS yet, you can access OSMO using port forwarding as an a
       <node-name>       default   default        0/2028         0/2       1/32         0/8
       ========================================================================================
 
-2. **Access OSMO UI** (in a separate terminal):
-
-   .. code-block:: bash
-
-      $ kubectl port-forward service/osmo-ui 3000:80 -n osmo-minimal
-
-   Then access the OSMO UI at http://localhost:3000 in your web browser. You should be able to see the OSMO UI dashboard as a guest user.
-
-.. important::
+2. **Access OSMO UI**:
 
-   - If you are accessing OSMO with port forwarding, the router service will not be accessible
-   - Consequently, ``osmo workflow port-forward`` or ``osmo workflow exec`` commands are not expected to work
+   Access the OSMO UI at http://localhost:9000 in your web browser. You should be able to see the OSMO UI dashboard as a guest user.
 
 Step 10: Basic Configuration
 ============================
@@ -652,27 +512,23 @@ After deployment, you need to configure a central storage for workflow spec, wor
 
 2. Follow the :ref:`installing_required_dependencies` guide to install the KAI scheduler for running workflows.
 
-3. **(Optional)** If you your ingress is not configured, you will need to set the following config with OSMO CLI for workflows to run:
+3. Set the service base URL so that workflow pods can reach the gateway:
 
    .. code-block:: bash
 
-      $ cat << EOF > /tmp/osmo_logger_config.json
+      $ cat << EOF > /tmp/osmo_service_config.json
       {
-      "service_base_url": "http://osmo-logger.osmo-minimal.svc.cluster.local:80"
+        "service_base_url": "http://osmo-gateway.osmo-minimal.svc.cluster.local"
       }
       EOF
 
-      $ osmo config update SERVICE --file /tmp/osmo_logger_config.json
+      $ osmo config update SERVICE --file /tmp/osmo_service_config.json
 
 Testing Your Deployment
 ========================
 
 Follow the :ref:`validate_osmo` guide to test basic OSMO functionality.
 
-.. warning::
-
-   When accessing OSMO through port forwarding, you will not be able to run interactive workflows involving ``port-forwarding`` or ``exec`` functionality.
-
 What's Next
 ============
 
diff --git a/docs/deployment_guide/getting_started/deploy_service.rst b/docs/deployment_guide/getting_started/deploy_service.rst
index 892aa055b..6940e0f74 100644
--- a/docs/deployment_guide/getting_started/deploy_service.rst
+++ b/docs/deployment_guide/getting_started/deploy_service.rst
@@ -216,7 +216,7 @@ Create ``osmo_values.yaml`` for the OSMO service with the following sample. Conf
   :icon: file
 
   .. code-block:: yaml
-    :emphasize-lines: 4, 21, 23, 29, 38, 41-46, 50, 133, 137, 156-158, 173-175
+    :emphasize-lines: 4, 21, 23, 29, 38, 41-46, 112, 116, 130-132, 147-149
 
     # Global configuration shared across all OSMO services
     global:
@@ -265,24 +265,6 @@ Create ``osmo_values.yaml`` for the OSMO service with the following sample. Conf
           token_endpoint: <idp-token-url>
           logout_endpoint: <idp-logout-url>
 
-        # Ingress configuration
-        ingress:
-          ingressClass: <your-ingress-class>  # e.g. alb, nginx
-          albAnnotations:
-            enabled: false  # Set to true if using AWS ALB
-            # sslCertArn: <your-ssl-cert-arn> # Set to the ARN of the SSL certificate for the ingress if using AWS ALB
-          sslEnabled: false  # Set to true if managing SSL at the ingress level
-          annotations:
-            ## when using nginx ingress, add the following annotations to handle large OAuth2 response headers from identity providers
-            # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-            # nginx.ingress.kubernetes.io/proxy-buffers: "8 16k"
-            # nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
-            # nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"
-            ## when using AWS ALB in addtional to the default alb annotations,
-            ## add the following annotations to specify the scheme of the ingress rules
-            # alb.ingress.kubernetes.io/scheme: internet-facing # set to internal for private subnet ALB
-            # alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
-            # alb.ingress.kubernetes.io/ssl-redirect: '443'
         # Resource allocation
         resources:
           requests:
@@ -346,17 +328,9 @@ Create ``osmo_values.yaml`` for the OSMO service with the following sample. Conf
 
     # Gateway — deploys Envoy, OAuth2 Proxy, and Authz as separate services
     gateway:
-      enabled: true
-
       envoy:
-        enabled: true
         hostname: <your-domain>
 
-        ingress:
-          enabled: true
-          ingressClass: <your-ingress-class>  # e.g. alb, nginx
-          sslEnabled: false
-
         # IDP hostname for JWT JWKS fetching
         idp:
           host: login.microsoftonline.com  # hostname from jwt.providers.jwks_uri
@@ -426,7 +400,7 @@ Create ``router_values.yaml`` for router with the following sample configuration
   :icon: file
 
   .. code-block:: yaml
-    :emphasize-lines: 4, 22, 29, 57
+    :emphasize-lines: 4, 22, 36
 
     # Global configuration shared across router services
     global:
@@ -453,27 +427,6 @@ Create ``router_values.yaml`` for router with the following sample configuration
         # webserverEnabled: true  # (Optional): Enable for UI port forwarding
         serviceAccountName: router
 
-        # Ingress configuration
-        ingress:
-          prefix: /
-          ingressClass: <your-ingress-class>  # e.g. alb, nginx
-          albAnnotations:
-            enabled: false  # Set to true if using AWS ALB
-            # sslCertArn: arn:aws:acm:us-west-2:XXXXXXXXX:certificate/YYYYYYYY # (Optional): Set to the ARN of the SSL certificate for the ingress if using AWS ALB
-          sslEnabled: false  # Set to true if managing SSL at the ingress level
-          sslSecret: osmo-tls
-          annotations:
-            # when using nginx ingress, add the following annotations to handle large OAuth2 response headers from identity providers
-            # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-            # nginx.ingress.kubernetes.io/proxy-buffers: "8 16k"
-            # nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
-            # nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"
-            ## when using AWS ALB in addtional to the default alb annotations,
-            ## add the following annotations to specify the scheme of the ingress rules
-            # alb.ingress.kubernetes.io/scheme: internet-facing # set to internal for private subnet ALB
-            # alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
-            # alb.ingress.kubernetes.io/ssl-redirect: '443'
-
         # Resource allocation
         resources:
           requests:
@@ -498,7 +451,7 @@ Create ``ui_values.yaml`` for ui with the following sample configurations:
   :icon: file
 
   .. code-block:: yaml
-    :emphasize-lines: 4, 10, 15
+    :emphasize-lines: 4, 10-11
 
     # Global configuration shared across UI services
     global:
@@ -510,27 +463,7 @@ Create ``ui_values.yaml`` for ui with the following sample configurations:
       # UI service configuration
       ui:
         hostname: <your-domain>
-
-        # Ingress configuration
-        ingress:
-          prefix: /
-          ingressClass: <your-ingress-class>  # e.g. alb, nginx
-          albAnnotations:
-            enabled: false  # Set to true if using AWS ALB
-            # sslCertArn: arn:aws:acm:us-west-2:XXXXXXXXX:certificate/YYYYYYYY # (Optional): Set to the ARN of the SSL certificate for the ingress if using AWS ALB
-          sslEnabled: false  # Set to true if managing SSL at the ingress level
-          sslSecret: osmo-tls
-          annotations:
-            # when using nginx ingress, add the following annotations to handle large OAuth2 response headers from identity providers
-            # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-            # nginx.ingress.kubernetes.io/proxy-buffers: "8 16k"
-            # nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
-            # nginx.ingress.kubernetes.io/large-client-header-buffers: "4 16k"
-            ## when using AWS ALB in addtional to the default alb annotations,
-            ## add the following annotations to specify the scheme of the ingress rules
-            # alb.ingress.kubernetes.io/scheme: internet-facing # set to internal for private subnet ALB
-            # alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
-            # alb.ingress.kubernetes.io/ssl-redirect: '443'
+        apiHostname: osmo-gateway:80
 
         # Resource allocation
         resources:
@@ -544,9 +477,7 @@ Create ``ui_values.yaml`` for ui with the following sample configurations:
    Replace all ``<your-*>`` placeholders with your actual values before applying. You can find them in the highlighted sections in all the files above.
 
 .. note::
-   Refer to the `README <https://github.com/NVIDIA/OSMO/blob/main/deployments/charts/service/README.md>`_ page for detailed configuration options.
-
-Similar values files should be created for other components (Router, UI) with their specific configurations.
+   Refer to the `README <https://github.com/NVIDIA/OSMO/blob/main/deployments/charts/service/README.md>`_ page for detailed configuration options, including gateway configuration.
 
 Step 4: Deploy Components
 =========================
@@ -598,30 +529,25 @@ Step 5: Verify Deployment
    .. code-block:: bash
 
     $ kubectl get services -n osmo
-      NAME           TYPE        CLUSTER-IP        EXTERNAL-IP   PORT(S)   AGE
-      osmo-agent     ClusterIP   xxx               <none>        80/TCP    <age>
-      osmo-logger    ClusterIP   xxx               <none>        80/TCP    <age>
-      osmo-router    ClusterIP   xxx               <none>        80/TCP    <age>
-      osmo-service   ClusterIP   xxx               <none>        80/TCP    <age>
-      osmo-ui        ClusterIP   xxx               <none>        80/TCP    <age>
+      NAME                TYPE           CLUSTER-IP        EXTERNAL-IP   PORT(S)           AGE
+      osmo-agent          ClusterIP      xxx               <none>        80/TCP            <age>
+      osmo-gateway        LoadBalancer   xxx               <external>    80/TCP,443/TCP    <age>
+      osmo-logger         ClusterIP      xxx               <none>        80/TCP            <age>
+      osmo-router         ClusterIP      xxx               <none>        80/TCP            <age>
+      osmo-service        ClusterIP      xxx               <none>        80/TCP            <age>
+      osmo-ui             ClusterIP      xxx               <none>        80/TCP            <age>
 
-3. Verify ingress configuration:
+3. Verify gateway service:
 
    .. code-block:: bash
 
-    $ kubectl get ingress -n osmo
-    NAME           CLASS   HOSTS                          ADDRESS         PORTS     AGE
-    osmo-agent     nginx   <your-domain>                  <lb-ip>        80, 443    <age>
-    osmo-logger    nginx   <your-domain>                  <lb-ip>        80, 443    <age>
-    osmo-router    nginx   <your-domain>                  <lb-ip>        80, 443    <age>
-    osmo-service   nginx   <your-domain>                  <lb-ip>        80, 443    <age>
-    osmo-ui        nginx   <your-domain>                  <lb-ip>        80, 443    <age>
-    osmo-ui-trpc   nginx   <your-domain>                  <lb-ip>        80, 443    <age>
+    $ kubectl get services -n osmo | grep gateway
+      osmo-gateway        LoadBalancer   xxx               <external>    80/TCP,443/TCP    <age>
 
 Step 6: Post-deployment Configuration
 =====================================
 
-1. Configure DNS records to point to your load balancer. For example, create a record for ``osmo.example.com`` to point to the load balancer IP.
+1. Configure DNS records to point to the ``osmo-gateway`` service's external IP or hostname. For example, create a CNAME record for ``osmo.example.com`` pointing to the LoadBalancer hostname shown in ``kubectl get svc osmo-gateway -n osmo``.
 
 2. Test authentication flow
 
@@ -648,6 +574,6 @@ Troubleshooting
 
    * **Database connection failures**: Verify the database is running and accessible
    * **Authentication configuration issues**: Verify the authentication configuration is correct
-   * **Ingress routing problems**: Verify the ingress is configured correctly
+   * **Gateway routing problems**: Verify the gateway pods are running and the ``osmo-gateway`` service has an external IP (``kubectl get svc osmo-gateway -n osmo``)
    * **Resource constraints**: Verify the resource limits are set correctly
    * **Missing secrets or incorrect configurations**: Verify the secrets are created correctly and the configurations are correct
diff --git a/docs/deployment_guide/getting_started/infrastructure_setup.rst b/docs/deployment_guide/getting_started/infrastructure_setup.rst
index e6e5484ec..c7b18b670 100644
--- a/docs/deployment_guide/getting_started/infrastructure_setup.rst
+++ b/docs/deployment_guide/getting_started/infrastructure_setup.rst
@@ -152,7 +152,7 @@ Configure Networking
 **External Connections:**
 
 - Kubernetes → Cloud Storage *(Outbound internet or VPC endpoint)*
-- User → Kubernetes *(Internet access via load balancer/ingress)*
+- User → OSMO Gateway *(Internet access via LoadBalancer service)*
 
 
 Best Practices
diff --git a/docs/deployment_guide/requirements/networking.rst b/docs/deployment_guide/requirements/networking.rst
index 8af099405..4d56c040e 100644
--- a/docs/deployment_guide/requirements/networking.rst
+++ b/docs/deployment_guide/requirements/networking.rst
@@ -38,13 +38,12 @@ Requirements
   .. grid:: 2
       :gutter: 3
 
-      .. grid-item-card:: :octicon:`server` Kubernetes Ingress Controller
-          :link: https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/
+      .. grid-item-card:: :octicon:`server` OSMO Gateway
           :class-card: tool-card
 
-          Install a Kubernetes load balancer in your cluster.
+          The OSMO Gateway (Envoy) is deployed automatically as part of the service chart. It handles traffic routing, authentication, and load balancing.
 
-          **Required for**: Load balancing and traffic routing
+          **Required for**: External access to OSMO services
 
       .. grid-item-card:: :octicon:`shield-check` Domain and Certificate
 
@@ -57,7 +56,7 @@ Requirements
 
       .. grid-item-card:: :octicon:`globe` DNS Configuration
 
-          Configure DNS CNAME record pointing your FQDN to the load balancer endpoint.
+          Configure DNS CNAME record pointing your FQDN to the OSMO Gateway's LoadBalancer external IP.
 
           **Required for**: Domain name resolution
 
diff --git a/run/minimal/backend_operator_values.yaml b/run/minimal/backend_operator_values.yaml
index e51e7f4a3..a4e3fce53 100644
--- a/run/minimal/backend_operator_values.yaml
+++ b/run/minimal/backend_operator_values.yaml
@@ -18,7 +18,7 @@ global:
   osmoImageLocation: nvcr.io/nvidia/osmo
   osmoImageTag: latest
   imagePullSecret: imagepullsecret
-  serviceUrl: http://ingress-nginx-controller.ingress-nginx.svc.cluster.local
+  serviceUrl: http://osmo-gateway.osmo.svc.cluster.local
   backendNamespace: default
   backendTestNamespace: osmo-test
   backendName: default
diff --git a/run/minimal/osmo_values.yaml b/run/minimal/osmo_values.yaml
index d27fd244e..cf379d04b 100644
--- a/run/minimal/osmo_values.yaml
+++ b/run/minimal/osmo_values.yaml
@@ -44,12 +44,10 @@ services:
       hostPath: /var/lib/localstack
 
   service:
-    hostname: ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    hostname: osmo-gateway.osmo.svc.cluster.local
     scaling:
       minReplicas: 1
       maxReplicas: 1
-    ingress:
-      sslEnabled: false
     extraEnv:
     - name: AWS_ENDPOINT_URL_S3
       value: http://localstack-s3:4566
@@ -94,18 +92,14 @@ services:
     - name: AWS_DEFAULT_REGION
       value: us-east-1
 
-sidecars:
+gateway:
   envoy:
+    scaling:
+      minReplicas: 1
+      maxReplicas: 1
+    service:
+      httpsPort: null
+  oauth2Proxy:
     enabled: false
-
-  logAgent:
-    enabled: false
-
-    logrotate:
-      enabled: false
-
-  otel:
-    enabled: false
-
-  rateLimit:
+  authz:
     enabled: false
diff --git a/run/minimal/router_values.yaml b/run/minimal/router_values.yaml
index 95680cb85..70eb3e2a9 100644
--- a/run/minimal/router_values.yaml
+++ b/run/minimal/router_values.yaml
@@ -29,16 +29,7 @@ services:
     password: "osmo"
 
   service:
-    hostname: ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    hostname: osmo-gateway.osmo.svc.cluster.local
     scaling:
       minReplicas: 1
       maxReplicas: 1
-    ingress:
-      sslEnabled: false
-
-sidecars:
-  envoy:
-    enabled: false
-
-  logAgent:
-    enabled: false
diff --git a/run/minimal/ui_values.yaml b/run/minimal/ui_values.yaml
index 57e3b46b5..651e55bf9 100644
--- a/run/minimal/ui_values.yaml
+++ b/run/minimal/ui_values.yaml
@@ -23,14 +23,8 @@ global:
 services:
   ui:
     skipAuth: true
-    hostname: ingress-nginx-controller.ingress-nginx.svc.cluster.local
-    ingress:
-      sslEnabled: false
+    hostname: osmo-gateway.osmo.svc.cluster.local
+    apiHostname: osmo-gateway.osmo.svc.cluster.local:80
     extraEnvs:
       - name: NEXT_PUBLIC_OSMO_SSL_ENABLED
         value: false
-
-# Updated structure: moved from service-sidecar to sidecars
-sidecars:
-  envoy:
-    enabled: false
diff --git a/run/start_service_kind.py b/run/start_service_kind.py
index 91d74dad3..9f4c2da6a 100644
--- a/run/start_service_kind.py
+++ b/run/start_service_kind.py
@@ -43,78 +43,6 @@
 RUNFILES = runfiles.Create()
 
 
-def _add_ingress_nginx_repo() -> None:
-    """Add the ingress-nginx repository to Helm."""
-    process = run_command_with_logging([
-        'helm', 'repo', 'add', 'ingress-nginx', 'https://kubernetes.github.io/ingress-nginx'
-    ], 'Adding ingress-nginx repository')
-
-    if not process.has_failed():
-        logger.info('✅ Ingress-nginx repository added successfully in %.2fs',
-                    process.get_elapsed_time())
-
-        process = run_command_with_logging([
-            'helm', 'repo', 'update'
-        ], 'Updating Helm repositories')
-
-        if not process.has_failed():
-            logger.info('✅ Helm repositories updated successfully in %.2fs',
-                        process.get_elapsed_time())
-        else:
-            logger.warning('⚠️  Warning: Failed to update Helm repositories')
-            logger.debug('   Check stderr: %s', process.stderr_file)
-    else:
-        logger.error('❌ Error adding ingress-nginx repository')
-        logger.error('   Check output files for details:')
-        logger.error('   - stdout: %s', process.stdout_file)
-        logger.error('   - stderr: %s', process.stderr_file)
-        raise RuntimeError('Error adding ingress-nginx repository')
-
-
-def _wait_for_ingress_controller() -> None:
-    """Wait for the ingress-nginx controller to be ready using kubectl wait.
-
-    Cannot use helm --wait because an IP address is never assigned.
-    """
-    process = run_command_with_logging([
-        'kubectl', 'wait', '--for=condition=available', '--timeout=300s',
-        'deployment/ingress-nginx-controller', '-n', 'ingress-nginx'
-    ], 'Waiting for ingress-nginx controller')
-
-    if not process.has_failed():
-        logger.info('✅ Ingress-nginx controller is ready in %.2fs', process.get_elapsed_time())
-    else:
-        logger.error(
-            '❌ Error: Ingress-nginx controller failed to become ready within timeout')
-        logger.error('   Check stderr: %s', process.stderr_file)
-        raise RuntimeError('Ingress-nginx controller failed to become ready within timeout')
-
-
-def _install_ingress_nginx() -> None:
-    """Install the ingress-nginx controller."""
-    logger.info('📦 Installing ingress-nginx...')
-
-    _add_ingress_nginx_repo()
-
-    process = run_command_with_logging([
-        'helm', 'upgrade', '--install', 'ingress-nginx', 'ingress-nginx/ingress-nginx',
-        '--create-namespace', '--namespace', 'ingress-nginx',
-        '--set', 'controller.nodeSelector.node_group=service',
-        '--set', 'controller.service.type=NodePort',
-        '--set', 'controller.service.nodePorts.http=30080'
-    ], 'Installing ingress-nginx')
-
-    if not process.has_failed():
-        logger.info('✅ Ingress-nginx installed successfully in %.2fs', process.get_elapsed_time())
-        _wait_for_ingress_controller()
-    else:
-        logger.error('❌ Error installing ingress-nginx')
-        logger.error('   Check output files for details:')
-        logger.error('   - stdout: %s', process.stdout_file)
-        logger.error('   - stderr: %s', process.stderr_file)
-        raise RuntimeError('Error installing ingress-nginx')
-
-
 def _generate_mek() -> None:
     """Generate the Master Encryption Key (MEK) directly in Python if it doesn't exist."""
     logger.info('🔑 Checking for existing Master Encryption Key (MEK)...')
@@ -292,7 +220,6 @@ def start_service_kind(args: argparse.Namespace) -> None:
             args.container_registry,
             args.container_registry_username,
             args.container_registry_password)
-        _install_ingress_nginx()
         _generate_mek()
         _install_osmo_services(args.image_location, args.image_tag, detected_platform)