diff --git a/braintrust/ci/values-google.yaml b/braintrust/ci/values-google.yaml
index 22c2127..1b271a8 100644
--- a/braintrust/ci/values-google.yaml
+++ b/braintrust/ci/values-google.yaml
@@ -42,7 +42,9 @@ api:
   backfillDisableNonhistorical: false
   allowInvalidBase64: false
   nodeMemoryPercent: "80"
-  extraEnvVars: []
+  extraEnvVars:
+    - name: AWS_REGION
+      value: "us-central1"
   nodeSelector: {}
   tolerations: []
   affinity: {}
diff --git a/braintrust/templates/_api-deployment.tpl b/braintrust/templates/_api-deployment.tpl
index 62433ff..5942533 100644
--- a/braintrust/templates/_api-deployment.tpl
+++ b/braintrust/templates/_api-deployment.tpl
@@ -231,6 +231,9 @@ spec:
             - name: PIP_CERT
               value: {{ $customCAPath | quote }}
             {{- end }}
+            {{- with $api.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
             {{- with $api.extraEnvVars }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
diff --git a/braintrust/templates/_helpers.tpl b/braintrust/templates/_helpers.tpl
index c5b85ab..a8282bb 100644
--- a/braintrust/templates/_helpers.tpl
+++ b/braintrust/templates/_helpers.tpl
@@ -65,16 +65,23 @@ http://{{ .Values.api.service.name | default .Values.api.name }}.{{ include "bra
 
 {{/*
 Build one API pool from the shared api values plus pool-specific overrides.
-Pool extraEnvVars are appended so shared provider configuration is retained.
+Pool platformEnvVars and extraEnvVars are appended so shared provider
+configuration is retained. platformEnvVars stay ahead of extraEnvVars.
+The kubelet keeps the last duplicate env name, so a user extraEnvVars
+entry overrides a platformEnvVars entry of the same name.
 */}}
 {{- define "braintrust.apiPoolConfig" -}}
 {{- $base := deepCopy .root.Values.api -}}
 {{- $_ := unset $base "workloadIsolation" -}}
 {{- $overrides := deepCopy (.overrides | default dict) -}}
+{{- $basePlatformEnvVars := get $base "platformEnvVars" | default (list) -}}
+{{- $poolPlatformEnvVars := get $overrides "platformEnvVars" | default (list) -}}
+{{- $_ := unset $overrides "platformEnvVars" -}}
 {{- $baseExtraEnvVars := get $base "extraEnvVars" | default (list) -}}
 {{- $poolExtraEnvVars := get $overrides "extraEnvVars" | default (list) -}}
 {{- $_ := unset $overrides "extraEnvVars" -}}
 {{- $pool := mergeOverwrite $base $overrides -}}
+{{- $_ := set $pool "platformEnvVars" (concat $basePlatformEnvVars $poolPlatformEnvVars) -}}
 {{- $_ := set $pool "extraEnvVars" (concat $baseExtraEnvVars $poolExtraEnvVars) -}}
 {{- toYaml $pool -}}
 {{- end -}}
@@ -238,6 +245,7 @@ ephemeralStorage:
 tmpVolume:
   enabled: false
   sizeLimit: ""
+platformEnvVars: []
 extraEnvVars: []
 nodeSelector: {}
 tolerations: []
diff --git a/braintrust/templates/ai-gateway-deployment.yaml b/braintrust/templates/ai-gateway-deployment.yaml
index e78b254..6ba995c 100644
--- a/braintrust/templates/ai-gateway-deployment.yaml
+++ b/braintrust/templates/ai-gateway-deployment.yaml
@@ -83,8 +83,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: BRAINSTORE_LICENSE_KEY
-            {{- if .Values.aiGateway.extraEnvVars }}
-            {{- toYaml .Values.aiGateway.extraEnvVars | nindent 12 }}
+            {{- with .Values.aiGateway.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.aiGateway.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
       {{- with .Values.aiGateway.extraContainers }}
       {{- toYaml . | nindent 8 }}
diff --git a/braintrust/templates/api-configmap.yaml b/braintrust/templates/api-configmap.yaml
index 41643ba..c23748e 100644
--- a/braintrust/templates/api-configmap.yaml
+++ b/braintrust/templates/api-configmap.yaml
@@ -1,13 +1,29 @@
 {{- $orgName := .Values.global.orgName | default "" | toString | trim -}}
 {{- $primaryOrgName := .Values.global.primaryOrgName | default "" | toString | trim -}}
-{{- $hasPrimaryOrgNameExtraEnv := false -}}
-{{- range .Values.api.extraEnvVars -}}
-{{- if eq (.name | default "" | toString) "PRIMARY_ORG_NAME" -}}
-{{- $hasPrimaryOrgNameExtraEnv = true -}}
+{{- $apiEnvVars := concat (.Values.api.platformEnvVars | default (list)) (.Values.api.extraEnvVars | default (list)) -}}
+{{- $hasPrimaryOrgNameEnv := false -}}
+{{- $hasAwsRegionEnv := false -}}
+{{- range $apiEnvVars -}}
+{{- $envName := .name | default "" | toString | trim -}}
+{{- if eq $envName "PRIMARY_ORG_NAME" -}}
+{{- $hasPrimaryOrgNameEnv = true -}}
 {{- end -}}
+{{- if eq $envName "AWS_REGION" -}}
+{{- /* Last duplicate wins, matching kubelet env precedence. A later blank literal clears an earlier region. valueFrom is accepted without inspecting the secret. */ -}}
+{{- if .valueFrom -}}
+{{- $hasAwsRegionEnv = true -}}
+{{- else if ne (.value | default "" | toString | trim) "" -}}
+{{- $hasAwsRegionEnv = true -}}
+{{- else -}}
+{{- $hasAwsRegionEnv = false -}}
 {{- end -}}
-{{- if and (or (eq $orgName "") (eq $orgName "*")) (eq $primaryOrgName "") (not $hasPrimaryOrgNameExtraEnv) -}}
-{{- fail "global.primaryOrgName or api.extraEnvVars PRIMARY_ORG_NAME is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization." -}}
+{{- end -}}
+{{- end -}}
+{{- if and (or (eq $orgName "") (eq $orgName "*")) (eq $primaryOrgName "") (not $hasPrimaryOrgNameEnv) -}}
+{{- fail "global.primaryOrgName or PRIMARY_ORG_NAME in api.platformEnvVars or api.extraEnvVars is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization." -}}
+{{- end -}}
+{{- if and (eq (.Values.cloud | default "") "google") (not .Values.api.enableGcsAuth) (not $hasAwsRegionEnv) -}}
+{{- fail "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region." -}}
 {{- end -}}
 {{- $allowedOrgIds := .Values.global.allowedOrgIds | default "" | toString | trim -}}
 {{- $btqlStrictOrgIds := .Values.btqlAuditLogsStrictOrgIds | default list -}}
diff --git a/braintrust/templates/brainstore-automationwriter-deployment.yaml b/braintrust/templates/brainstore-automationwriter-deployment.yaml
index e8fd45a..7133ebb 100644
--- a/braintrust/templates/brainstore-automationwriter-deployment.yaml
+++ b/braintrust/templates/brainstore-automationwriter-deployment.yaml
@@ -157,8 +157,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if $aw.extraEnvVars }}
-            {{- toYaml $aw.extraEnvVars | nindent 12 }}
+            {{- with $aw.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with $aw.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume
diff --git a/braintrust/templates/brainstore-fastreader-deployment.yaml b/braintrust/templates/brainstore-fastreader-deployment.yaml
index 6ca1d5e..9ed567c 100644
--- a/braintrust/templates/brainstore-fastreader-deployment.yaml
+++ b/braintrust/templates/brainstore-fastreader-deployment.yaml
@@ -142,8 +142,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if .Values.brainstore.fastreader.extraEnvVars }}
-            {{- toYaml .Values.brainstore.fastreader.extraEnvVars | nindent 12 }}
+            {{- with .Values.brainstore.fastreader.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.brainstore.fastreader.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume
diff --git a/braintrust/templates/brainstore-reader-deployment.yaml b/braintrust/templates/brainstore-reader-deployment.yaml
index f0342a7..bf5d08a 100644
--- a/braintrust/templates/brainstore-reader-deployment.yaml
+++ b/braintrust/templates/brainstore-reader-deployment.yaml
@@ -142,8 +142,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if .Values.brainstore.reader.extraEnvVars }}
-            {{- toYaml .Values.brainstore.reader.extraEnvVars | nindent 12 }}
+            {{- with .Values.brainstore.reader.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.brainstore.reader.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume
diff --git a/braintrust/templates/brainstore-writer-deployment.yaml b/braintrust/templates/brainstore-writer-deployment.yaml
index f42b692..ef1a846 100644
--- a/braintrust/templates/brainstore-writer-deployment.yaml
+++ b/braintrust/templates/brainstore-writer-deployment.yaml
@@ -142,8 +142,11 @@ spec:
                 secretKeyRef:
                   name: braintrust-secrets
                   key: FUNCTION_SECRET_KEY
-            {{- if .Values.brainstore.writer.extraEnvVars }}
-            {{- toYaml .Values.brainstore.writer.extraEnvVars | nindent 12 }}
+            {{- with .Values.brainstore.writer.platformEnvVars }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.brainstore.writer.extraEnvVars }}
+            {{- toYaml . | nindent 12 }}
             {{- end }}
           volumeMounts:
             - name: cache-volume
diff --git a/braintrust/tests/__fixtures__/google-values.yaml b/braintrust/tests/__fixtures__/google-values.yaml
index 8655dd0..70176d8 100644
--- a/braintrust/tests/__fixtures__/google-values.yaml
+++ b/braintrust/tests/__fixtures__/google-values.yaml
@@ -11,6 +11,11 @@ objectStorage:
     brainstoreBucket: "test-brainstore-bucket"
     apiBucket: "test-api-bucket"
 
+api:
+  extraEnvVars:
+    - name: AWS_REGION
+      value: "us-central1"
+
 brainstore:
   serviceAccount:
     googleServiceAccount: "test@project.iam.gserviceaccount.com"
diff --git a/braintrust/tests/api-autoscaling_test.yaml b/braintrust/tests/api-autoscaling_test.yaml
index cb22f4c..adcefc6 100644
--- a/braintrust/tests/api-autoscaling_test.yaml
+++ b/braintrust/tests/api-autoscaling_test.yaml
@@ -14,6 +14,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: false
     release:
       namespace: "braintrust"
@@ -27,6 +30,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: false
     release:
       namespace: "braintrust"
@@ -53,6 +59,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
     release:
       namespace: "braintrust"
@@ -96,6 +105,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
     release:
       namespace: "braintrust"
@@ -157,6 +169,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.replicas: 4
     release:
@@ -184,6 +199,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.extraEnvVars:
         - name: ENABLE_PROMETHEUS_METRICS
@@ -206,6 +224,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: false
       api.replicas: 4
     release:
@@ -230,6 +251,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -244,6 +268,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -268,6 +295,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -295,6 +325,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -319,6 +352,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -340,6 +376,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
     release:
@@ -362,6 +401,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
@@ -382,6 +424,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
@@ -397,6 +442,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
@@ -422,6 +470,9 @@ tests:
       - __fixtures__/base-values.yaml
     set:
       cloud: google
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: us-central1
       api.autoscaling.enabled: true
       api.workloadIsolation.enabled: true
       api.workloadIsolation.ingest.autoscaling.enabled: false
diff --git a/braintrust/tests/api-configmap_test.yaml b/braintrust/tests/api-configmap_test.yaml
index 27de0d0..16895ef 100644
--- a/braintrust/tests/api-configmap_test.yaml
+++ b/braintrust/tests/api-configmap_test.yaml
@@ -122,6 +122,25 @@ tests:
           path: data.PRIMARY_ORG_NAME
           value: "primary-org"
 
+  - it: should allow wildcard org name when primary org name is provided via module env vars
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      global.orgName: "*"
+      global.primaryOrgName: ""
+      api.platformEnvVars:
+        - name: PRIMARY_ORG_NAME
+          value: "primary-org"
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: data.ORG_NAME
+          value: "*"
+      - equal:
+          path: data.PRIMARY_ORG_NAME
+          value: ""
+
   - it: should allow wildcard org name when primary org name is provided via extra env vars
     values:
       - __fixtures__/base-values.yaml
@@ -151,7 +170,7 @@ tests:
       namespace: "braintrust"
     asserts:
       - failedTemplate:
-          errorMessage: "global.primaryOrgName or api.extraEnvVars PRIMARY_ORG_NAME is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization."
+          errorMessage: "global.primaryOrgName or PRIMARY_ORG_NAME in api.platformEnvVars or api.extraEnvVars is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization."
 
   - it: should reject wildcard org name without primary org name
     values:
@@ -163,7 +182,7 @@ tests:
       namespace: "braintrust"
     asserts:
       - failedTemplate:
-          errorMessage: "global.primaryOrgName or api.extraEnvVars PRIMARY_ORG_NAME is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization."
+          errorMessage: "global.primaryOrgName or PRIMARY_ORG_NAME in api.platformEnvVars or api.extraEnvVars is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization."
 
   - it: should use correct namespace from helper when createNamespace is false
     values:
@@ -262,6 +281,166 @@ tests:
       - equal:
           path: data.AWS_RESPONSE_CHECKSUM_VALIDATION
           value: "WHEN_REQUIRED"
+      - isNull:
+          path: data.AWS_REGION
+
+  - it: should allow a Google HMAC deployment that sets AWS_REGION via extraEnvVars
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars: []
+      api.extraEnvVars:
+        - name: AWS_REGION
+          value: "us-central1"
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: data.AWS_ENDPOINT_URL
+          value: "https://storage.googleapis.com"
+
+  - it: should allow a Google HMAC deployment that sets AWS_REGION via platformEnvVars
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.extraEnvVars: []
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: "us-central1"
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: data.AWS_ENDPOINT_URL
+          value: "https://storage.googleapis.com"
+
+  - it: should reject a Google HMAC deployment with no AWS_REGION
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars: []
+      api.extraEnvVars: []
+    release:
+      namespace: "braintrust"
+    asserts:
+      - failedTemplate:
+          errorMessage: "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region."
+
+  - it: should reject a blank AWS_REGION literal in extraEnvVars
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars: []
+      api.extraEnvVars:
+        - name: AWS_REGION
+          value: ""
+    release:
+      namespace: "braintrust"
+    asserts:
+      - failedTemplate:
+          errorMessage: "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region."
+
+  - it: should reject a name-only AWS_REGION entry
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars: []
+      api.extraEnvVars:
+        - name: AWS_REGION
+    release:
+      namespace: "braintrust"
+    asserts:
+      - failedTemplate:
+          errorMessage: "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region."
+
+  - it: should reject a whitespace-only AWS_REGION value
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.extraEnvVars: []
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: "   "
+    release:
+      namespace: "braintrust"
+    asserts:
+      - failedTemplate:
+          errorMessage: "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region."
+
+  - it: should reject a later blank AWS_REGION that overrides a real one
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: "us-central1"
+      api.extraEnvVars:
+        - name: AWS_REGION
+          value: ""
+    release:
+      namespace: "braintrust"
+    asserts:
+      - failedTemplate:
+          errorMessage: "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region."
+
+  - it: should allow AWS_REGION from valueFrom without a literal value
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars: []
+      api.extraEnvVars:
+        - name: AWS_REGION
+          valueFrom:
+            secretKeyRef:
+              name: braintrust-secrets
+              key: AWS_REGION
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: data.AWS_ENDPOINT_URL
+          value: "https://storage.googleapis.com"
+
+  - it: should let a later literal AWS_REGION replace a blank platform entry
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: ""
+      api.extraEnvVars:
+        - name: AWS_REGION
+          value: "us-central1"
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: data.AWS_ENDPOINT_URL
+          value: "https://storage.googleapis.com"
+
+  - it: should reject a whitespace-only env name as AWS_REGION
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.extraEnvVars: []
+      api.platformEnvVars:
+        - name: "   "
+          value: "us-central1"
+    release:
+      namespace: "braintrust"
+    asserts:
+      - failedTemplate:
+          errorMessage: "api.platformEnvVars or api.extraEnvVars AWS_REGION is required when cloud is google and api.enableGcsAuth is false; S3-compatible GCS needs a region."
 
   - it: should not set checksum vars when enableGcsAuth is true
     values:
@@ -282,6 +461,28 @@ tests:
           path: data.AWS_REQUEST_CHECKSUM_CALCULATION
       - isNull:
           path: data.AWS_RESPONSE_CHECKSUM_VALIDATION
+      - isNull:
+          path: data.AWS_REGION
+      - isNull:
+          path: data.AWS_DEFAULT_REGION
+
+  - it: should not require a GCS region when enableGcsAuth is true
+    values:
+      - __fixtures__/base-values.yaml
+      - __fixtures__/google-values.yaml
+    set:
+      api.enableGcsAuth: true
+      api.serviceAccount.googleServiceAccount: "test@project.iam.gserviceaccount.com"
+      api.platformEnvVars: []
+      api.extraEnvVars: []
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: data.ENABLE_GCS_AUTH
+          value: "true"
+      - isNull:
+          path: data.AWS_REGION
 
   - it: should configure brainstore URLs correctly
     values:
diff --git a/braintrust/tests/api-workload-isolation_test.yaml b/braintrust/tests/api-workload-isolation_test.yaml
index 6464553..b3ff0cf 100644
--- a/braintrust/tests/api-workload-isolation_test.yaml
+++ b/braintrust/tests/api-workload-isolation_test.yaml
@@ -102,6 +102,157 @@ tests:
             name: POOL_SETTING
             value: background
 
+  - it: should keep platformEnvVars when extraEnvVars is overridden on every API pool
+    template: api-deployment.yaml
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      api.workloadIsolation.enabled: true
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: from-module
+        - name: SHARED_NAME
+          value: module-value
+      api.extraEnvVars:
+        - name: USER_ONLY
+          value: from-user
+        - name: SHARED_NAME
+          value: user-value
+      api.workloadIsolation.ingest.platformEnvVars:
+        - name: INGEST_MODULE
+          value: ingest
+      api.workloadIsolation.background.extraEnvVars:
+        - name: BACKGROUND_USER
+          value: background
+    documentIndex: 0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[-4].name
+          value: AWS_REGION
+      - equal:
+          path: spec.template.spec.containers[0].env[-4].value
+          value: from-module
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].name
+          value: SHARED_NAME
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].value
+          value: module-value
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].name
+          value: USER_ONLY
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].value
+          value: from-user
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].name
+          value: SHARED_NAME
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].value
+          value: user-value
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: INGEST_MODULE
+            value: ingest
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: BACKGROUND_USER
+            value: background
+
+  - it: should append ingest platformEnvVars after the shared platform list
+    template: api-deployment.yaml
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      api.workloadIsolation.enabled: true
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: from-module
+      api.extraEnvVars:
+        - name: USER_ONLY
+          value: from-user
+      api.workloadIsolation.ingest.platformEnvVars:
+        - name: INGEST_MODULE
+          value: ingest
+    documentIndex: 1
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: AWS_REGION
+            value: from-module
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: INGEST_MODULE
+            value: ingest
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].name
+          value: AWS_REGION
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].value
+          value: from-module
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].name
+          value: INGEST_MODULE
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].value
+          value: ingest
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].name
+          value: USER_ONLY
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].value
+          value: from-user
+
+  - it: should append background extraEnvVars after shared platformEnvVars and extraEnvVars
+    template: api-deployment.yaml
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      api.workloadIsolation.enabled: true
+      api.platformEnvVars:
+        - name: AWS_REGION
+          value: from-module
+      api.extraEnvVars:
+        - name: USER_ONLY
+          value: from-user
+      api.workloadIsolation.background.extraEnvVars:
+        - name: BACKGROUND_USER
+          value: background
+    documentIndex: 2
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: AWS_REGION
+            value: from-module
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: USER_ONLY
+            value: from-user
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].name
+          value: AWS_REGION
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].value
+          value: from-module
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].name
+          value: USER_ONLY
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].value
+          value: from-user
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].name
+          value: BACKGROUND_USER
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].value
+          value: background
+
   - it: should render an isolated ingest Service with inherited annotations
     template: api-service.yaml
     values:
diff --git a/braintrust/tests/brainstore-writer_test.yaml b/braintrust/tests/brainstore-writer_test.yaml
index d2af988..4521d97 100644
--- a/braintrust/tests/brainstore-writer_test.yaml
+++ b/braintrust/tests/brainstore-writer_test.yaml
@@ -318,6 +318,49 @@ tests:
             name: CUSTOM_VAR
             value: "custom-value"
 
+  - it: should render platformEnvVars before extraEnvVars so the user value wins
+    template: brainstore-writer-deployment.yaml
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      brainstore.writer.platformEnvVars:
+        - name: MODULE_VAR
+          value: from-module
+        - name: SHARED_NAME
+          value: module-value
+      brainstore.writer.extraEnvVars:
+        - name: USER_VAR
+          value: from-user
+        - name: SHARED_NAME
+          value: user-value
+    release:
+      namespace: "braintrust"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[-4].name
+          value: MODULE_VAR
+      - equal:
+          path: spec.template.spec.containers[0].env[-4].value
+          value: from-module
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].name
+          value: SHARED_NAME
+      - equal:
+          path: spec.template.spec.containers[0].env[-3].value
+          value: module-value
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].name
+          value: USER_VAR
+      - equal:
+          path: spec.template.spec.containers[0].env[-2].value
+          value: from-user
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].name
+          value: SHARED_NAME
+      - equal:
+          path: spec.template.spec.containers[0].env[-1].value
+          value: user-value
+
   - it: should include livenessProbe when configured
     template: brainstore-writer-deployment.yaml
     values:
diff --git a/braintrust/values.yaml b/braintrust/values.yaml
index d91754f..628c20c 100644
--- a/braintrust/values.yaml
+++ b/braintrust/values.yaml
@@ -2,7 +2,7 @@
 global:
   orgName: "<your org name on Braintrust>"
   # Required when orgName is empty or "*" unless PRIMARY_ORG_NAME is supplied
-  # via api.extraEnvVars. Used to authorize self-hosted service-token management.
+  # via api.platformEnvVars or api.extraEnvVars. Used to authorize self-hosted service-token management.
   primaryOrgName: ""
   # Optional comma-separated Braintrust Org ID allowlist (IDs, not org names).
   # Do not include spaces. If orgName is a specific name, that org is included
@@ -273,6 +273,9 @@ api:
   # validation may allow even if private or reserved. Hard-blocked metadata,
   # link-local, multicast, unspecified, and future-use ranges remain blocked.
   urlSecurityAllowCidrs: ""
+  # Reserved for the installer (the Terraform module). Hand-edited values belong in extraEnvVars.
+  # Setting platformEnvVars by hand replaces the platform list.
+  platformEnvVars: []
   extraEnvVars:
     # Example:
     # - name: MY_ENV_VAR
@@ -364,6 +367,9 @@ aiGateway:
     timeoutSeconds: 5
     failureThreshold: 3
     successThreshold: 1
+  # Reserved for the installer (the Terraform module). Hand-edited values belong in extraEnvVars.
+  # Setting platformEnvVars by hand replaces the platform list.
+  platformEnvVars: []
   extraEnvVars: []
   nodeSelector: {}
   tolerations: []
@@ -467,6 +473,9 @@ brainstore:
     tmpVolume:
       enabled: false
       sizeLimit: ""
+    # Reserved for the installer (the Terraform module). Hand-edited values belong in extraEnvVars.
+    # Setting platformEnvVars by hand replaces the platform list.
+    platformEnvVars: []
     extraEnvVars: []
     nodeSelector: {}
     tolerations: []
@@ -525,6 +534,9 @@ brainstore:
     tmpVolume:
       enabled: false
       sizeLimit: ""
+    # Reserved for the installer (the Terraform module). Hand-edited values belong in extraEnvVars.
+    # Setting platformEnvVars by hand replaces the platform list.
+    platformEnvVars: []
     extraEnvVars: []
     nodeSelector: {}
     tolerations: []
@@ -584,6 +596,9 @@ brainstore:
     tmpVolume:
       enabled: false
       sizeLimit: ""
+    # Reserved for the installer (the Terraform module). Hand-edited values belong in extraEnvVars.
+    # Setting platformEnvVars by hand replaces the platform list.
+    platformEnvVars: []
     extraEnvVars: []
     # Example:
     # - name: MY_ENV_VAR
@@ -660,6 +675,9 @@ brainstore:
     tmpVolume:
       enabled: false
       sizeLimit: ""
+    # Reserved for the installer (the Terraform module). Hand-edited values belong in extraEnvVars.
+    # Setting platformEnvVars by hand replaces the platform list.
+    platformEnvVars: []
     extraEnvVars: []
     # Example:
     # - name: MY_ENV_VAR