diff --git a/helm/.gitignore b/.gitignore
similarity index 92%
rename from helm/.gitignore
rename to .gitignore
index 6ee1d9b..2dbd412 100644
--- a/helm/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@ charts/
 # IDE
 .idea/
 .vscode/
+settings.json
 *.swp
 *.swo
 
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index 6f0cb5d..95c7ebf 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -2,10 +2,10 @@ apiVersion: v2
 name: socket-firewall
 description: Socket.dev Registry Firewall - Block vulnerable packages before they reach your cluster
 type: application
-version: 0.8.0
+version: 0.9.0
 # appVersion is the single source of truth for the firewall image version.
 # image.tag in values.yaml defaults to this (see templates/_helpers.tpl).
-appVersion: "2.0.3"
+appVersion: "2.0.5"
 keywords:
   - security
   - supply-chain
diff --git a/helm/README.md b/helm/README.md
index ab52417..c9d9244 100644
--- a/helm/README.md
+++ b/helm/README.md
@@ -126,6 +126,7 @@ registries:
 | `tls.generateSelfSigned` | Generate self-signed certs | `true` |
 | `tls.existingSecret` | Use existing TLS secret | `""` |
 | `service.type` | Service type | `ClusterIP` |
+| `service.externalTrafficPolicy` | `Cluster` or `Local` (NodePort/LoadBalancer only); use `Local` to preserve client source IPs | `""` |
 | `ingress.enabled` | Enable Ingress | `false` |
 | `ingress.className` | Ingress class (nginx, alb, traefik) | `""` |
 | `autoscaling.enabled` | Enable HorizontalPodAutoscaler | `false` |
diff --git a/helm/templates/service.yaml b/helm/templates/service.yaml
index f06a872..8f19854 100644
--- a/helm/templates/service.yaml
+++ b/helm/templates/service.yaml
@@ -10,6 +10,9 @@ metadata:
   {{- end }}
 spec:
   type: {{ .Values.service.type }}
+  {{- if and .Values.service.externalTrafficPolicy (has .Values.service.type (list "NodePort" "LoadBalancer")) }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
+  {{- end }}
   ports:
     - port: {{ .Values.service.httpPort }}
       targetPort: http
diff --git a/helm/values.yaml b/helm/values.yaml
index 2b463ef..95d2bb3 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -600,6 +600,12 @@ service:
   containerHttpsPort: ""
   # Override HTTPS targetPort (set to "http" when TLS is terminated at the load balancer)
   httpsTargetPort: ""
+  # External traffic policy (Cluster or Local). Only applies when type is
+  # NodePort or LoadBalancer. Set to "Local" to preserve client source IPs;
+  # the default "Cluster" policy SNATs traffic forwarded across nodes (e.g. to
+  # a link-local 169.254.x.x address on GKE Dataplane v2 passthrough LBs).
+  # Note: with "Local", only nodes running a firewall pod receive traffic.
+  externalTrafficPolicy: ""
   annotations: {}
     # service.beta.kubernetes.io/aws-load-balancer-internal: "true"
     # service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"