diff --git a/helm/templates/deployment.yaml b/helm/templates/deployment.yaml
index ad4c3197..6e5866d2 100644
--- a/helm/templates/deployment.yaml
+++ b/helm/templates/deployment.yaml
@@ -14,6 +14,7 @@ spec:
       labels:
         {{- include "stac-auth-proxy.selectorLabels" . | nindent 8 }}
     spec:
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
       serviceAccountName: {{ include "stac-auth-proxy.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
@@ -31,6 +32,24 @@ spec:
             - name: http
               containerPort: 8000
               protocol: TCP
+          {{- with .Values.startupProbe }}
+          startupProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if .Values.preStopSleepSeconds }}
+          lifecycle:
+            preStop:
+              exec:
+                command: ["sleep", "{{ .Values.preStopSleepSeconds }}"]
+          {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           env:
diff --git a/helm/values.schema.yaml b/helm/values.schema.yaml
index 8990bc47..b4c5d360 100644
--- a/helm/values.schema.yaml
+++ b/helm/values.schema.yaml
@@ -201,6 +201,33 @@ properties:
             description: "List of capabilities to drop"
     description: "Container-level security context"
 
+  terminationGracePeriodSeconds:
+    type: integer
+    minimum: 1
+    description: "Duration in seconds the pod needs to terminate gracefully. Must be greater than preStopSleepSeconds."
+    default: 30
+
+  preStopSleepSeconds:
+    type: integer
+    minimum: 0
+    description: "Seconds to sleep in preStop hook before SIGTERM, allowing Kubernetes endpoint propagation. Set to 0 to disable."
+    default: 15
+
+  startupProbe:
+    type: object
+    additionalProperties: true
+    description: "Startup probe configuration. Disables liveness/readiness probes until startup succeeds."
+
+  livenessProbe:
+    type: object
+    additionalProperties: true
+    description: "Liveness probe configuration. Determines if the container should be restarted."
+
+  readinessProbe:
+    type: object
+    additionalProperties: true
+    description: "Readiness probe configuration. Determines if the container should receive traffic."
+
   nodeSelector:
     type: object
     additionalProperties:
diff --git a/helm/values.yaml b/helm/values.yaml
index 18250a3b..7794e329 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -42,6 +42,37 @@ containerSecurityContext:
     drop:
       - ALL
 
+# Graceful shutdown: delays SIGTERM to allow Kubernetes endpoint propagation.
+# The preStop hook runs BEFORE SIGTERM is sent, giving kube-proxy time to
+# remove the pod from service endpoints so no new traffic arrives during shutdown.
+# terminationGracePeriodSeconds must be > preStopSleepSeconds + app shutdown time.
+terminationGracePeriodSeconds: 30
+preStopSleepSeconds: 5
+
+# Probes
+# startupProbe disables liveness/readiness checks until startup succeeds,
+# giving the app time to wait for upstream services (e.g. during node scaling).
+startupProbe:
+  httpGet:
+    path: /healthz
+    port: http
+  periodSeconds: 2
+  failureThreshold: 30  # 60s total for startup
+
+livenessProbe:
+  httpGet:
+    path: /healthz
+    port: http
+  periodSeconds: 60
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /healthz
+    port: http
+  periodSeconds: 5
+  failureThreshold: 3
+
 nodeSelector: {}
 tolerations: []
 affinity: {}