diff --git a/helm-overrides/k8s-admin-prd-ase1/prometheus/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/prometheus/custom-values.yaml
new file mode 100644
index 0000000..cfaca6f
--- /dev/null
+++ b/helm-overrides/k8s-admin-prd-ase1/prometheus/custom-values.yaml
@@ -0,0 +1,49 @@
+prometheus:
+  # Server only. alertmanager/kube-state-metrics/node-exporter/pushgateway
+  # are all enabled by default in this chart — none were asked for, and
+  # none are needed for what actually consumes this: toolshed's per-app
+  # CPU/memory come straight from kubelet's own cAdvisor endpoint (the
+  # kubernetes-nodes-cadvisor scrape job below, built into the server
+  # itself), not from any of these four. Each is its own pod on an 8GB
+  # node that was already at its ceiling before this — see claude.md's
+  # resource budget table.
+  alertmanager:
+    enabled: false
+  kube-state-metrics:
+    enabled: false
+  prometheus-node-exporter:
+    enabled: false
+  prometheus-pushgateway:
+    enabled: false
+
+  server:
+    persistentVolume:
+      # local-path-provisioner, this cluster's default StorageClass —
+      # installed right after Cilium precisely because kubeadm ships no
+      # default (unlike k3s). 3Gi rather than the chart's 8Gi default:
+      # `retention: 7d` below on one small cluster's worth of series
+      # comfortably fits, and the node has no room to spare. Not
+      # resizable in place with this provisioner, so sized deliberately
+      # rather than grown later.
+      size: 3Gi
+      storageClass: local-path
+
+    # 7 days, not the chart's 15-day default — a homelab whose entire
+    # purpose is proving a CI/CD pipeline has no use for a month of
+    # historical series, and every extra day is disk this node does not
+    # have spare.
+    retention: 7d
+
+    resources:
+      requests:
+        cpu: 50m
+        memory: 128Mi
+      limits:
+        memory: 512Mi
+
+  # The default kubernetes-nodes-cadvisor job (scheme https, bearer token
+  # from the pod's own ServiceAccount, metrics_path /metrics/cadvisor) is
+  # left exactly as the chart ships it — this is what
+  # container_cpu_usage_seconds_total and container_memory_working_set_bytes
+  # come from, and toolshed's metrics connection (internal/metrics)
+  # queries exactly those two, summed by namespace.
diff --git a/helm-templates/prometheus/Chart.lock b/helm-templates/prometheus/Chart.lock
new file mode 100644
index 0000000..e19a075
--- /dev/null
+++ b/helm-templates/prometheus/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: prometheus
+  repository: https://prometheus-community.github.io/helm-charts
+  version: 29.27.1
+digest: sha256:1cd0daed07160b46100e5cccade430dadcd2f9a3974bd3667a09787c603a6ad0
+generated: "2026-09-06T07:25:57.847789+05:30"
diff --git a/helm-templates/prometheus/Chart.yaml b/helm-templates/prometheus/Chart.yaml
new file mode 100644
index 0000000..acee77a
--- /dev/null
+++ b/helm-templates/prometheus/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+name: prometheus
+version: 1.0.0
+dependencies:
+  - name: prometheus
+    # Pinned to the latest stable at the time this was vendored (2026-09).
+    # Bump deliberately later, with a changelog read first, same as any
+    # other chart bump in this repo.
+    version: 29.27.1
+    repository: https://prometheus-community.github.io/helm-charts
diff --git a/helm-templates/prometheus/charts/prometheus-29.27.1.tgz b/helm-templates/prometheus/charts/prometheus-29.27.1.tgz
new file mode 100644
index 0000000..1659762
Binary files /dev/null and b/helm-templates/prometheus/charts/prometheus-29.27.1.tgz differ