diff --git a/charts/sourcegraph/CHANGELOG.md b/charts/sourcegraph/CHANGELOG.md
index 62c4280df..9f8ad6c40 100644
--- a/charts/sourcegraph/CHANGELOG.md
+++ b/charts/sourcegraph/CHANGELOG.md
@@ -8,6 +8,8 @@ Use `**BREAKING**:` to denote a breaking change
 
 ## Unreleased
 
+- Added `<serviceName>.extraInitContainers` to every workload, rendered before any init containers the chart defines, so e.g. a secrets-fetching init container on `frontend` runs before `migrator`. Use `restartPolicy: Always` for a native sidecar that must be started before the main container, such as one that writes a `grafana` datasource credential file read by `datasources.yml`.
+- Added `<serviceName>.extraServicePorts` to append ports to each component's primary Service (`sourcegraph-frontend`, `indexed-search`, and `worker`, not `sourcegraph-frontend-internal`, `indexed-search-indexer`, or `worker-executors`), e.g. to expose a sidecar's port
 - Removed the hardcoded `PRECISE_CODE_INTEL_UPLOAD_BACKEND=blobstore` and `PRECISE_CODE_INTEL_UPLOAD_AWS_ENDPOINT=http://blobstore:9000` environment variables from `frontend`, `worker`, `precise-code-intel-worker`, and `syntactic-code-intel-worker`. They matched Sourcegraph's built-in defaults, so default deployments are unchanged. `SOURCEGRAPH_UPLOAD_*` in `*.env` is now the only object storage configuration in the chart, as in the `external-object-storage` examples. Previously, with `blobstore.enabled: true`, the chart's values were rendered after `*.env` and overrode any `PRECISE_CODE_INTEL_UPLOAD_*` set there. Helm's three-way merge removes every duplicate of those names on this upgrade, including the `*.env` override, and the override is applied on the next `helm upgrade` after this one, when code-intel uploads switch to its bucket. Before that, make sure the bucket exists, or move the settings to `SOURCEGRAPH_UPLOAD_*`, or remove them. Run a second `helm upgrade` right away to make the switch at a known time.
 - Added `syntacticCodeIntel.storageType`, `syntacticCodeIntel.storageSize`, and `syntacticCodeIntel.storageClassName`, so the `syntactic-code-intel-worker` `/tmp` scratch volume can be a per-pod PVC (generic ephemeral volume) instead of an `emptyDir` on the node boot disk, matching `preciseCodeIntel`. The default remains an unbounded `emptyDir`.
 - Added an `outbound-http-proxy` example, which routes outbound traffic from frontend, worker, and migrator through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`
@@ -27,7 +29,6 @@ Use `**BREAKING**:` to denote a breaking change
 - Added a `network-policy` example, which limits Executor and Executor job pods to the frontend API
 - Corrected the external object storage examples to configure the shared store for frontend, worker, precise code intel, syntactic code intel, gitserver, and searcher, including credentials or workload service accounts as required.
 - Removed the unused application ports from the precise and syntactic code intel worker Deployments and Services; health checks and Prometheus metrics continue to use the debug server on port 6060.
-- Added `grafana.initContainers`, so a native sidecar (`restartPolicy: Always`) can be started before `grafana`, e.g. to write a datasource credential file that `datasources.yml` reads with `$__file{}`
 - Added `gitserver.storageAccessModes` (default `["ReadWriteOnce"]`) to allow `["ReadWriteOncePod"]`, which lets Kubernetes mount the repos volume with `-o context` on SELinux-enforcing nodes (e.g. Bottlerocket / EKS Auto Mode) instead of recursively relabeling every file on each pod start. Changing this on an existing deployment requires recreating the StatefulSet and PVC, as both fields are immutable.
 - Added configurable pre-shutdown pauses, graceful-shutdown timeouts, and termination grace periods for application services
 - Added optional `syntectServer.podDisruptionBudget` support
diff --git a/charts/sourcegraph/README.md b/charts/sourcegraph/README.md
index 2c58812af..31e0d10fb 100644
--- a/charts/sourcegraph/README.md
+++ b/charts/sourcegraph/README.md
@@ -81,6 +81,8 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.terminationGracePeriodSeconds` - override `sourcegraph.terminationGracePeriodSeconds` for this service
 - `<serviceName>.args` - override default container args
 - `<serviceName>.env` - consult `values.yaml` file
+- `<serviceName>.extraInitContainers` - add init containers to the pod, which run before any init containers the chart defines
+- `<serviceName>.extraServicePorts` - add ports to the service's primary Service. The OpenTelemetry and Jaeger values are `openTelemetry.gateway.*`, `openTelemetry.agent.extraInitContainers`, `jaeger.extraInitContainers`, `jaeger.collector.extraServicePorts`, and `jaeger.query.extraServicePorts`
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.
@@ -208,7 +210,6 @@ In addition to the documented values, all services also support the following va
 | grafana.existingConfig | string | `""` | Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key. |
 | grafana.image.defaultTag | string | `<appVersion>@sha256:<digest>`, pinned by each release | Docker image tag for the `grafana` image |
 | grafana.image.name | string | `"grafana"` | Docker image name for the `grafana` image |
-| grafana.initContainers | list | `[]` | Init containers for the `grafana` pod. Use `restartPolicy: Always` for a native sidecar that must be started before `grafana`, such as one that writes a datasource credential file read by `datasources.yml` |
 | grafana.name | string | `"grafana"` | Name used by resources. Does not affect service names or PVCs. |
 | grafana.podSecurityContext | object | `{"fsGroup":472,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":472,"runAsUser":472}` | Security context for the `grafana` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) |
 | grafana.resources | object | `{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"100m","memory":"512Mi"}}` | Resource requests & limits for the `grafana` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) |
diff --git a/charts/sourcegraph/README.md.gotmpl b/charts/sourcegraph/README.md.gotmpl
index b2fb8bba1..b4151fd4e 100644
--- a/charts/sourcegraph/README.md.gotmpl
+++ b/charts/sourcegraph/README.md.gotmpl
@@ -81,6 +81,8 @@ In addition to the documented values, all services also support the following va
 - `<serviceName>.terminationGracePeriodSeconds` - override `sourcegraph.terminationGracePeriodSeconds` for this service
 - `<serviceName>.args` - override default container args
 - `<serviceName>.env` - consult `values.yaml` file
+- `<serviceName>.extraInitContainers` - add init containers to the pod, which run before any init containers the chart defines
+- `<serviceName>.extraServicePorts` - add ports to the service's primary Service. The OpenTelemetry and Jaeger values are `openTelemetry.gateway.*`, `openTelemetry.agent.extraInitContainers`, `jaeger.extraInitContainers`, `jaeger.collector.extraServicePorts`, and `jaeger.query.extraServicePorts`
 - `<serviceName>.serivceAccount.create` - create service account for service
 - `<serviceName>.serviceAccount.annotations` - Annotations for the service-specific service account
 - `<serviceName>.image.repository` - override the global `sourcegraph.image.repository` (registry or prefix) for this service. Defaults to `sourcegraph.image.repository` when unset.
diff --git a/charts/sourcegraph/templates/_worker.tpl b/charts/sourcegraph/templates/_worker.tpl
index cc64d5893..fdc7a08f3 100644
--- a/charts/sourcegraph/templates/_worker.tpl
+++ b/charts/sourcegraph/templates/_worker.tpl
@@ -65,6 +65,10 @@ spec:
         {{- end }}
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list $top "worker") | nindent 6 }}
+      {{- with $top.Values.worker.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: worker
         env:
diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
index 2a330d383..8a1bd9273 100644
--- a/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
+++ b/charts/sourcegraph/templates/blobstore/blobstore.Deployment.yaml
@@ -43,6 +43,10 @@ spec:
         deploy: sourcegraph
         app: blobstore
     spec:
+      {{- with .Values.blobstore.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: blobstore
         env:
diff --git a/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml b/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
index f5ca88cdb..f54a75765 100644
--- a/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
+++ b/charts/sourcegraph/templates/blobstore/blobstore.Service.yaml
@@ -19,6 +19,9 @@ spec:
   - name: http
     port: 9000
     targetPort: http
+  {{- with .Values.blobstore.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: blobstore
diff --git a/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml b/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml
index e9814a4e7..456b7a57f 100644
--- a/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml
+++ b/charts/sourcegraph/templates/cadvisor/cadvisor.DaemonSet.yaml
@@ -43,6 +43,10 @@ spec:
         app: cadvisor
     spec:
       {{- include "sourcegraph.renderServiceAccountName" (list . "cadvisor") | trim | nindent 6 }}
+      {{- with .Values.cadvisor.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: cadvisor
         image: {{ include "sourcegraph.image" (list . "cadvisor" ) }}
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml
index e071a6afa..00d3063dd 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: codeinsights-db
     port: 5432
     targetPort: codeinsights-db
+  {{- with .Values.codeInsightsDB.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: codeinsights-db
diff --git a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml
index d0585e3fa..b2868f32e 100644
--- a/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/codeinsights-db/codeinsights-db.StatefulSet.yaml
@@ -44,6 +44,9 @@ spec:
         group: backend
     spec:
       initContainers:
+      {{- with .Values.codeInsightsDB.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       - name: correct-data-dir-permissions
         image: {{ include "sourcegraph.image" (list . "alpine") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml
index d2d9c445e..ffb933d27 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: pgsql
     port: 5432
     targetPort: pgsql
+  {{- with .Values.codeIntelDB.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: codeintel-db
diff --git a/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml b/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml
index eff5c7275..9e537e749 100644
--- a/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/codeintel-db/codeintel-db.StatefulSet.yaml
@@ -44,6 +44,9 @@ spec:
         group: backend
     spec:
       initContainers:
+      {{- with .Values.codeIntelDB.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       - name: correct-data-dir-permissions
         image: {{ include "sourcegraph.image" (list . "alpine") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml
index ba9039430..c8e2e67ad 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Deployment.yaml
@@ -49,6 +49,9 @@ spec:
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "frontend") | nindent 6 }}
       initContainers:
+      {{- with .Values.frontend.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       {{- if .Values.migrator.enabled }}
       - name: migrator
         image: {{ include "sourcegraph.image" (list . "migrator") }}
diff --git a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml
index 1d64e7f2a..0181080c8 100644
--- a/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml
+++ b/charts/sourcegraph/templates/frontend/sourcegraph-frontend.Service.yaml
@@ -23,6 +23,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.frontend.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: sourcegraph-frontend
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml b/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml
index cc2621a3a..052f4303d 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.Service.yaml
@@ -30,6 +30,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.gitserver.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: gitserver
diff --git a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml
index 4a4f7ccae..ea4b43e11 100644
--- a/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/gitserver/gitserver.StatefulSet.yaml
@@ -44,6 +44,10 @@ spec:
         deploy: sourcegraph
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "gitserver") | nindent 6 }}
+      {{- with .Values.gitserver.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: gitserver
         args: {{- default (list "run") .Values.gitserver.args | toYaml | nindent 8 }}
diff --git a/charts/sourcegraph/templates/grafana/grafana.Service.yaml b/charts/sourcegraph/templates/grafana/grafana.Service.yaml
index c58c419ab..d2f1851fd 100644
--- a/charts/sourcegraph/templates/grafana/grafana.Service.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.Service.yaml
@@ -19,6 +19,9 @@ spec:
   - name: http
     port: 30070
     targetPort: http
+  {{- with .Values.grafana.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: grafana
diff --git a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
index 1dfc52b51..2fa847f2f 100644
--- a/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml
@@ -42,7 +42,7 @@ spec:
         app: grafana
         deploy: sourcegraph
     spec:
-      {{- with .Values.grafana.initContainers }}
+      {{- with .Values.grafana.extraInitContainers }}
       initContainers:
         {{- toYaml . | nindent 6 }}
       {{- end }}
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml
index 16e140ecd..ab5efe433 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.Service.yaml
@@ -23,6 +23,9 @@ spec:
   - name: grpc
     port: 6070
     targetPort: grpc
+  {{- with .Values.indexedSearch.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: indexed-search
diff --git a/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml b/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml
index 0b1b63178..aa10a5ffb 100644
--- a/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/indexed-search/indexed-search.StatefulSet.yaml
@@ -41,6 +41,10 @@ spec:
         app: indexed-search
         deploy: sourcegraph
     spec:
+      {{- with .Values.indexedSearch.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: zoekt-webserver
         image: {{ include "sourcegraph.image" (list . "indexedSearch") }}
diff --git a/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml b/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml
index c03facd04..3665df98e 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger-collector.Service.yaml
@@ -25,6 +25,9 @@ spec:
     port: 4317
     protocol: TCP
     targetPort: grpc-otlp
+  {{- with .Values.jaeger.collector.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.jaeger.selectorLabels" . | nindent 4 }}
     app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml b/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml
index 223e9209b..cfc9464b2 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger-query.Service.yaml
@@ -21,6 +21,9 @@ spec:
     port: 16686
     protocol: TCP
     targetPort: http
+  {{- with .Values.jaeger.query.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.jaeger.selectorLabels" . | nindent 4 }}
     app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
index 75c8961e8..856233e29 100644
--- a/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
+++ b/charts/sourcegraph/templates/jaeger/jaeger.Deployment.yaml
@@ -52,6 +52,10 @@ spec:
         deploy: sourcegraph
         app.kubernetes.io/component: all-in-one
     spec:
+      {{- with .Values.jaeger.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: jaeger
         image: {{ include "sourcegraph.image" (list . "jaeger") }}
diff --git a/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml b/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml
index db0bc0c3e..e9c27fb64 100644
--- a/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml
+++ b/charts/sourcegraph/templates/node-exporter/node-exporter.DaemonSet.yaml
@@ -44,6 +44,10 @@ spec:
       {{- if .Values.nodeExporter.serviceAccount.create }}
       {{- include "sourcegraph.renderServiceAccountName" (list . "nodeExporter") | trim | nindent 6 }}
       {{- end }}
+      {{- with .Values.nodeExporter.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: node-exporter
         image: {{ include "sourcegraph.image" (list . "nodeExporter" ) }}
diff --git a/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml b/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml
index ce747c467..0e4de30f6 100644
--- a/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml
+++ b/charts/sourcegraph/templates/node-exporter/node-exporter.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: metrics
     port: 9100
     targetPort: metrics
+  {{- with .Values.nodeExporter.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: node-exporter
diff --git a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml
index d93c64b62..34e3c7ef2 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-agent.DaemonSet.yaml
@@ -39,6 +39,10 @@ spec:
         deploy: sourcegraph
         app: otel-agent
     spec:
+      {{- with .Values.openTelemetry.agent.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: otel-agent
         image: {{ include "sourcegraph.image" (list . "openTelemetry") }}
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
index 38d6d7c2f..f14d2dc3b 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Deployment.yaml
@@ -41,6 +41,10 @@ spec:
         deploy: sourcegraph
         app: otel-collector
     spec:
+      {{- with .Values.openTelemetry.gateway.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: otel-collector
         image: {{ include "sourcegraph.image" (list . "openTelemetry") }}
diff --git a/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml b/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml
index 3615de7a5..9e944cccc 100644
--- a/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml
+++ b/charts/sourcegraph/templates/otel-collector/otel-collector.Service.yaml
@@ -29,6 +29,9 @@ spec:
       port: 4318
       protocol: TCP
       targetPort: http-otlp
+  {{- with .Values.openTelemetry.gateway.extraServicePorts }}
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: otel-collector
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml b/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml
index 284d03483..d5bc49e81 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: pgsql
     port: 5432
     targetPort: pgsql
+  {{- with .Values.pgsql.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: pgsql
diff --git a/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml b/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml
index adccd43fb..5e8aa7d27 100644
--- a/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/pgsql/pgsql.StatefulSet.yaml
@@ -44,6 +44,9 @@ spec:
         group: backend
     spec:
       initContainers:
+      {{- with .Values.pgsql.extraInitContainers }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       - name: correct-data-dir-permissions
         image: {{ include "sourcegraph.image" (list . "alpine") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml
index be911b77f..7fa75d57b 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.Deployment.yaml
@@ -50,6 +50,10 @@ spec:
       {{- fail (printf "preciseCodeIntel.storageType must be one of emptyDir, pvc; got %q" $storageType) }}
       {{- end }}
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "preciseCodeIntel") | nindent 6 }}
+      {{- with .Values.preciseCodeIntel.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: precise-code-intel-worker
         env:
diff --git a/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml b/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml
index e0fcfe291..c1773e119 100644
--- a/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml
+++ b/charts/sourcegraph/templates/precise-code-intel/worker.Service.yaml
@@ -20,6 +20,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.preciseCodeIntel.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: precise-code-intel-worker
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
index 608379c47..8646b4693 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml
@@ -43,6 +43,10 @@ spec:
         deploy: sourcegraph
         app: prometheus
     spec:
+      {{- with .Values.prometheus.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: prometheus
         image: {{ include "sourcegraph.image" (list . "prometheus") }}
diff --git a/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml b/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml
index fffffa67a..4670f3b8c 100644
--- a/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml
+++ b/charts/sourcegraph/templates/prometheus/prometheus.Service.yaml
@@ -19,6 +19,9 @@ spec:
   - name: http
     port: 30090
     targetPort: http
+  {{- with .Values.prometheus.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: prometheus
diff --git a/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml b/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml
index 8492a9624..cc9013f70 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.Deployment.yaml
@@ -49,6 +49,10 @@ spec:
         deploy: sourcegraph
         app: redis-cache
     spec:
+      {{- with .Values.redisCache.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: redis-cache
         image: {{ include "sourcegraph.image" (list . "redisCache") }}
diff --git a/charts/sourcegraph/templates/redis/redis-cache.Service.yaml b/charts/sourcegraph/templates/redis/redis-cache.Service.yaml
index 301034b5b..3792f49dc 100644
--- a/charts/sourcegraph/templates/redis/redis-cache.Service.yaml
+++ b/charts/sourcegraph/templates/redis/redis-cache.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: redis
     port: 6379
     targetPort: redis
+  {{- with .Values.redisCache.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: redis-cache
diff --git a/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml b/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml
index c1a726a0f..ea498fcdb 100644
--- a/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.Deployment.yaml
@@ -49,6 +49,10 @@ spec:
         deploy: sourcegraph
         app: redis-store
     spec:
+      {{- with .Values.redisStore.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: redis-store
         image: {{ include "sourcegraph.image" (list . "redisStore") }}
diff --git a/charts/sourcegraph/templates/redis/redis-store.Service.yaml b/charts/sourcegraph/templates/redis/redis-store.Service.yaml
index eef4feeae..f3b700d4c 100644
--- a/charts/sourcegraph/templates/redis/redis-store.Service.yaml
+++ b/charts/sourcegraph/templates/redis/redis-store.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: redis
     port: 6379
     targetPort: redis
+  {{- with .Values.redisStore.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: redis-store
diff --git a/charts/sourcegraph/templates/searcher/searcher.Service.yaml b/charts/sourcegraph/templates/searcher/searcher.Service.yaml
index 185307a40..8c9388e94 100644
--- a/charts/sourcegraph/templates/searcher/searcher.Service.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.Service.yaml
@@ -24,6 +24,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.searcher.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: searcher
diff --git a/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml b/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml
index 76c71d47a..c11c53f1e 100644
--- a/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml
+++ b/charts/sourcegraph/templates/searcher/searcher.StatefulSet.yaml
@@ -44,6 +44,10 @@ spec:
         app: searcher
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "searcher") | nindent 6 }}
+      {{- with .Values.searcher.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: searcher
         {{- with .Values.searcher.args }}
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml
index 7c7839f09..42a24002d 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.Deployment.yaml
@@ -51,6 +51,10 @@ spec:
       {{- fail (printf "syntacticCodeIntel.storageType must be one of emptyDir, pvc; got %q" $storageType) }}
       {{- end }}
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "syntacticCodeIntel") | nindent 6 }}
+      {{- with .Values.syntacticCodeIntel.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: syntactic-code-intel-worker
         env:
diff --git a/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml b/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml
index 53282fc80..0b3bd3826 100644
--- a/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml
+++ b/charts/sourcegraph/templates/syntactic-code-intel/worker.Service.yaml
@@ -21,6 +21,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.syntacticCodeIntel.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: syntactic-code-intel-worker
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml
index 1195f6ad9..c68eb7ecc 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.Deployment.yaml
@@ -46,6 +46,10 @@ spec:
         app: syntect-server
     spec:
       {{- include "sourcegraph.terminationGracePeriodSeconds" (list . "syntectServer") | nindent 6 }}
+      {{- with .Values.syntectServer.extraInitContainers }}
+      initContainers:
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
       containers:
       - name: syntect-server
         env:
diff --git a/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml b/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml
index 9cc5b9faa..54b12e945 100644
--- a/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml
+++ b/charts/sourcegraph/templates/syntect-server/syntect-server.Service.yaml
@@ -23,6 +23,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.syntectServer.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: syntect-server
diff --git a/charts/sourcegraph/templates/worker/worker.Service.yaml b/charts/sourcegraph/templates/worker/worker.Service.yaml
index 9f4b8a297..2542ce514 100644
--- a/charts/sourcegraph/templates/worker/worker.Service.yaml
+++ b/charts/sourcegraph/templates/worker/worker.Service.yaml
@@ -23,6 +23,9 @@ spec:
   - name: http-debug
     port: 6060
     targetPort: http-debug
+  {{- with .Values.worker.extraServicePorts }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
   selector:
     {{- include "sourcegraph.selectorLabels" . | nindent 4 }}
     app: worker
diff --git a/charts/sourcegraph/tests/extraInitContainersServicePorts_test.yaml b/charts/sourcegraph/tests/extraInitContainersServicePorts_test.yaml
new file mode 100644
index 000000000..1571879a1
--- /dev/null
+++ b/charts/sourcegraph/tests/extraInitContainersServicePorts_test.yaml
@@ -0,0 +1,169 @@
+suite: extraInitContainers and extraServicePorts
+release:
+  name: sourcegraph
+  namespace: sourcegraph
+set:
+  jaeger:
+    enabled: true
+  syntacticCodeIntel:
+    enabled: true
+tests:
+- it: should render extraInitContainers first on every workload
+  templates:
+  - blobstore/blobstore.Deployment.yaml
+  - cadvisor/cadvisor.DaemonSet.yaml
+  - codeinsights-db/codeinsights-db.StatefulSet.yaml
+  - codeintel-db/codeintel-db.StatefulSet.yaml
+  - frontend/sourcegraph-frontend.Deployment.yaml
+  - gitserver/gitserver.StatefulSet.yaml
+  - grafana/grafana.StatefulSet.yaml
+  - indexed-search/indexed-search.StatefulSet.yaml
+  - jaeger/jaeger.Deployment.yaml
+  - node-exporter/node-exporter.DaemonSet.yaml
+  - otel-collector/otel-agent.DaemonSet.yaml
+  - otel-collector/otel-collector.Deployment.yaml
+  - pgsql/pgsql.StatefulSet.yaml
+  - precise-code-intel/worker.Deployment.yaml
+  - prometheus/prometheus.Deployment.yaml
+  - redis/redis-cache.Deployment.yaml
+  - redis/redis-store.Deployment.yaml
+  - searcher/searcher.StatefulSet.yaml
+  - syntactic-code-intel/worker.Deployment.yaml
+  - syntect-server/syntect-server.Deployment.yaml
+  - worker/worker.Deployment.yaml
+  set:
+    blobstore.extraInitContainers: &initContainers
+    - name: vault-init
+      image: vault-sidecar:0.12.4
+    cadvisor.extraInitContainers: *initContainers
+    codeInsightsDB.extraInitContainers: *initContainers
+    codeIntelDB.extraInitContainers: *initContainers
+    frontend.extraInitContainers: *initContainers
+    gitserver.extraInitContainers: *initContainers
+    grafana.extraInitContainers: *initContainers
+    indexedSearch.extraInitContainers: *initContainers
+    jaeger.extraInitContainers: *initContainers
+    nodeExporter.extraInitContainers: *initContainers
+    openTelemetry.agent.extraInitContainers: *initContainers
+    openTelemetry.gateway.extraInitContainers: *initContainers
+    pgsql.extraInitContainers: *initContainers
+    preciseCodeIntel.extraInitContainers: *initContainers
+    prometheus.extraInitContainers: *initContainers
+    redisCache.extraInitContainers: *initContainers
+    redisStore.extraInitContainers: *initContainers
+    searcher.extraInitContainers: *initContainers
+    syntacticCodeIntel.extraInitContainers: *initContainers
+    syntectServer.extraInitContainers: *initContainers
+    worker.extraInitContainers: *initContainers
+  asserts:
+  - equal:
+      path: spec.template.spec.initContainers[0].name
+      value: vault-init
+  - equal:
+      path: spec.template.spec.initContainers[0].image
+      value: vault-sidecar:0.12.4
+  - equal:
+      path: spec.template.spec.initContainers[1].name
+      value: migrator
+    template: frontend/sourcegraph-frontend.Deployment.yaml
+  - equal:
+      path: spec.template.spec.initContainers[1].name
+      value: correct-data-dir-permissions
+    template: pgsql/pgsql.StatefulSet.yaml
+  - equal:
+      path: spec.template.spec.initContainers[1].name
+      value: correct-data-dir-permissions
+    template: codeintel-db/codeintel-db.StatefulSet.yaml
+  - equal:
+      path: spec.template.spec.initContainers[1].name
+      value: correct-data-dir-permissions
+    template: codeinsights-db/codeinsights-db.StatefulSet.yaml
+
+- it: should not render initContainers by default on workloads without chart-defined init containers
+  templates:
+  - gitserver/gitserver.StatefulSet.yaml
+  - grafana/grafana.StatefulSet.yaml
+  - otel-collector/otel-collector.Deployment.yaml
+  - worker/worker.Deployment.yaml
+  asserts:
+  - notExists:
+      path: spec.template.spec.initContainers
+
+- it: should append extraServicePorts to every primary Service
+  templates:
+  - blobstore/blobstore.Service.yaml
+  - codeinsights-db/codeinsights-db.Service.yaml
+  - codeintel-db/codeintel-db.Service.yaml
+  - frontend/sourcegraph-frontend.Service.yaml
+  - gitserver/gitserver.Service.yaml
+  - grafana/grafana.Service.yaml
+  - indexed-search/indexed-search.Service.yaml
+  - jaeger/jaeger-collector.Service.yaml
+  - jaeger/jaeger-query.Service.yaml
+  - node-exporter/node-exporter.Service.yaml
+  - otel-collector/otel-collector.Service.yaml
+  - pgsql/pgsql.Service.yaml
+  - precise-code-intel/worker.Service.yaml
+  - prometheus/prometheus.Service.yaml
+  - redis/redis-cache.Service.yaml
+  - redis/redis-store.Service.yaml
+  - searcher/searcher.Service.yaml
+  - syntactic-code-intel/worker.Service.yaml
+  - syntect-server/syntect-server.Service.yaml
+  - worker/worker.Service.yaml
+  set:
+    blobstore.extraServicePorts: &servicePorts
+    - name: service-http
+      port: 80
+      targetPort: 8080
+    codeInsightsDB.extraServicePorts: *servicePorts
+    codeIntelDB.extraServicePorts: *servicePorts
+    frontend.extraServicePorts: *servicePorts
+    gitserver.extraServicePorts: *servicePorts
+    grafana.extraServicePorts: *servicePorts
+    indexedSearch.extraServicePorts: *servicePorts
+    jaeger.collector.extraServicePorts: *servicePorts
+    jaeger.query.extraServicePorts: *servicePorts
+    nodeExporter.extraServicePorts: *servicePorts
+    openTelemetry.gateway.extraServicePorts: *servicePorts
+    pgsql.extraServicePorts: *servicePorts
+    preciseCodeIntel.extraServicePorts: *servicePorts
+    prometheus.extraServicePorts: *servicePorts
+    redisCache.extraServicePorts: *servicePorts
+    redisStore.extraServicePorts: *servicePorts
+    searcher.extraServicePorts: *servicePorts
+    syntacticCodeIntel.extraServicePorts: *servicePorts
+    syntectServer.extraServicePorts: *servicePorts
+    worker.extraServicePorts: *servicePorts
+  asserts:
+  - contains:
+      path: spec.ports
+      content:
+        name: service-http
+        port: 80
+        targetPort: 8080
+  - lengthEqual:
+      path: spec.ports
+      count: 3
+    template: frontend/sourcegraph-frontend.Service.yaml
+  - lengthEqual:
+      path: spec.ports
+      count: 4
+    template: otel-collector/otel-collector.Service.yaml
+
+- it: should leave secondary Services unchanged when extraServicePorts is set
+  templates:
+  - frontend/sourcegraph-frontend-internal.Service.yaml
+  - indexed-search/indexed-search.IndexerService.yaml
+  - worker/worker-executors.Service.yaml
+  set:
+    frontend.extraServicePorts: &secondaryPorts
+    - name: service-http
+      port: 80
+      targetPort: 8080
+    indexedSearch.extraServicePorts: *secondaryPorts
+    worker.extraServicePorts: *secondaryPorts
+  asserts:
+  - lengthEqual:
+      path: spec.ports
+      count: 1
diff --git a/charts/sourcegraph/values.yaml b/charts/sourcegraph/values.yaml
index 170beae3c..dc02477c1 100644
--- a/charts/sourcegraph/values.yaml
+++ b/charts/sourcegraph/values.yaml
@@ -85,6 +85,10 @@ sourcegraph:
 #   extraVolumes: {}
 #   # Add sidecars
 #   extraContainers: {}
+#   # Add init containers, which run before any init containers the chart defines
+#   extraInitContainers: []
+#   # Add ports to the component's primary Service
+#   extraServicePorts: []
 #   # Toggle serviceAccount creation
 #   serviceAccount.create: true
 #   # Customize service account name
@@ -512,8 +516,6 @@ grafana:
     sslmode: ""
   # -- Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key.
   existingConfig: "" # Name of an existing configmap
-  # -- Init containers for the `grafana` pod. Use `restartPolicy: Always` for a native sidecar that must be started before `grafana`, such as one that writes a datasource credential file read by `datasources.yml`
-  initContainers: []
   image:
     # -- Docker image tag for the `grafana` image
     # @default -- `<appVersion>@sha256:<digest>`, pinned by each release