diff --git a/.github/workflows/federation-helm.yml b/.github/workflows/federation-helm.yml
index 7a02490..69d28a1 100644
--- a/.github/workflows/federation-helm.yml
+++ b/.github/workflows/federation-helm.yml
@@ -20,12 +20,13 @@
 # SKIPPED WITH A `::warning::` ANNOTATION (not failed). All static-validation gates run
 # UNCONDITIONALLY on every PR with zero external deps.
 #
-# LICENSE: the multi-sidecar (Pro) tiers are BEST-EFFORT, gated on TWO repo secrets
-# together (skip-not-fail if either missing), on top of image availability: (1) secret
-# SC4ES_PRO_TEST_JWT, (2) secret SC4ES_TEST_PUBLIC_KEY (injected as
-# SOFTCLIENT4ES_LICENSE_PUBLIC_KEY so the verifier resolves the test kid OFFLINE). The
-# published federation image must itself be Pro-capable (JWT-verifying SPI on classpath,
-# Story 16.1 OQ-5) for the Pro JWT to verify — an OSS-only image falls back to Community.
+# LICENSE: the multi-sidecar (Pro) tiers are BEST-EFFORT, gated on ONE repo secret
+# (skip-not-fail if missing), on top of image availability: SC4ES_PRO_TEST_JWT. As of
+# appVersion 0.3.0 the trust root is embedded in the image, so the JWT must be ISSUED BY
+# THE SOFTCLIENT4ES LICENCE SERVER — a self-signed test JWT can no longer be made to
+# verify by supplying its public key, and SC4ES_TEST_PUBLIC_KEY is gone. The published
+# federation image must itself be Pro-capable (JWT-verifying SPI on classpath, Story 16.1
+# OQ-5) for the Pro JWT to verify — an OSS-only image falls back to Community.
 # single-cluster + per-ES-version + secret backends + uninstall + ALL static gates are
 # license-free and run unconditionally (when the images are published).
 name: Federation Helm Chart
@@ -63,7 +64,7 @@ env:
   # public DockerHub tags at this version so the chart DEFAULTS resolve the kind-loaded images.
   # MUST match Chart.yaml appVersion — stale on the 0.2.2 train, reconciled on 0.2.3,
   # stale again on 0.2.4 (the chart bumped, this did not), reconciled on 0.2.5.
-  IMAGE_TAG: '0.2.5'
+  IMAGE_TAG: '0.3.0'
   FED_IMAGE: softnetwork/softclient4es-federation
   SIDECAR_IMAGE_PREFIX: softnetwork/softclient4es   # softclient4es<N>-arrow-flight-sql
   # A pre-baked ADBC client image avoids the smoke Job's runtime pip install (air-gap). When
@@ -138,6 +139,28 @@ jobs:
         run: |
           n=$(helm template fed "${CHART_DIR}" | grep -c '^kind: Secret' || true)
           [ "$n" = "0" ] || { echo "::error::chart must NOT render a kind:Secret (got $n)"; exit 1; }
+      - name: assert the removed licence public-key value fails LOUDLY (appVersion 0.3.0)
+        run: |
+          # The trust root is embedded in the image, so SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is
+          # ignored. A value that used to decide HOW a licence is verified must not decay into a
+          # silent no-op, so the chart aborts the render instead. Both halves are asserted: that
+          # it fails, and that the message still NAMES the value — an abort whose text drifted
+          # into something generic would leave an operator with no idea what to remove.
+          if out=$(helm template fed "${CHART_DIR}" --set license.publicKeySecretName=x 2>&1); then
+            echo "::error::chart rendered with license.publicKeySecretName set — the guard is gone"
+            exit 1
+          fi
+          case "$out" in
+            *license.publicKeySecretName*is\ no\ longer\ supported*) : ;;
+            *) echo "::error::render aborted, but not with the actionable guard message:"; echo "$out"; exit 1 ;;
+          esac
+          # And the variable must appear in NO rendered manifest, under any committed values.
+          for f in "${CHART_DIR}/tests/values"/*.yaml "${CHART_DIR}/examples"/*/values.yaml; do
+            [ -f "$f" ] || continue
+            if helm template fed "${CHART_DIR}" -f "$f" | grep -q 'SOFTCLIENT4ES_LICENSE_PUBLIC_KEY'; then
+              echo "::error::$f still renders SOFTCLIENT4ES_LICENSE_PUBLIC_KEY"; exit 1
+            fi
+          done
       - name: heterogeneous-ready discriminator (16.4 A2b — only signal vs three-region)
         run: |
           # three-region and heterogeneous-ready goldens are BYTE-IDENTICAL by design (Helm
@@ -225,13 +248,13 @@ jobs:
       - name: Skip multi-sidecar install when no Pro test license (FACT C + FACT F, best-effort tier)
         id: lic
         if: ${{ matrix.license && steps.guard.outputs.skip != 'true' }}
-        # The 3-sidecar tier needs BOTH: a Pro test JWT and its public verification key (so the
-        # verifier resolves the test kid OFFLINE). Missing EITHER → SKIP (annotation), never fail.
-        # (The published federation image must itself be Pro-capable — 16.1 OQ-5 — for the JWT to
-        # verify; an OSS-only image silently falls back to Community and CrashLoops at 3 clusters.)
+        # The 3-sidecar tier needs a licence-server-issued Pro JWT. Missing → SKIP (annotation),
+        # never fail. (The published federation image must itself be Pro-capable — 16.1 OQ-5 — for
+        # the JWT to verify; an OSS-only image silently falls back to Community and CrashLoops at
+        # 3 clusters.)
         run: |
-          if [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ] || [ -z "${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" ]; then
-            echo "::warning::missing SC4ES_PRO_TEST_JWT and/or SC4ES_TEST_PUBLIC_KEY — ${{ matrix.example }} (3 sidecars) needs a Pro JWT + its public key (FACT F #2); skipping (best-effort)"
+          if [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ]; then
+            echo "::warning::missing SC4ES_PRO_TEST_JWT — ${{ matrix.example }} (3 sidecars) needs a licence-server-issued Pro JWT; skipping (best-effort)"
             echo "skip=true" >> "$GITHUB_OUTPUT"
           fi
       - name: Set up Helm
@@ -258,30 +281,28 @@ jobs:
       - name: Deploy ES container(s) per sidecar (FACT D — reachable ES required)
         if: ${{ steps.guard.outputs.skip != 'true' && steps.lic.outputs.skip != 'true' }}
         run: ./.github/scripts/deploy-es.sh "${{ matrix.example }}" '${{ matrix.es }}'
-      - name: Create Pro license + public-key Secret (multi-sidecar only — FACT F #2)
+      - name: Create Pro license Secret (multi-sidecar only)
         if: ${{ matrix.license && steps.guard.outputs.skip != 'true' && steps.lic.outputs.skip != 'true' }}
         run: |
-          # ONE Secret carries both the JWT (license-key) and the public verification JWK
-          # (license-public-key → SOFTCLIENT4ES_LICENSE_PUBLIC_KEY, the air-gap path in
-          # LicenseKeyVerifier.loadPublicKey Step 3 — without it the test kid never resolves).
+          # JWT only. The verification key is embedded in the image as of appVersion 0.3.0, so
+          # there is no public-key half to supply any more.
           kubectl create secret generic sc4es-license \
-            --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" \
-            --from-literal=license-public-key="${{ secrets.SC4ES_TEST_PUBLIC_KEY }}"
+            --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}"
           # The three-region example pins per-region license.secretName=sc4es-pro-license; also
           # create that name so its bearer-auth sidecars + the federation share the test token.
           kubectl create secret generic sc4es-pro-license \
-            --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" \
-            --from-literal=license-public-key="${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" || true
+            --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" || true
       - name: helm install
         if: ${{ steps.guard.outputs.skip != 'true' && steps.lic.outputs.skip != 'true' }}
         run: |
           # The example values point sidecars[].elasticsearch.url at external https://*.example.com
           # placeholders. deploy-es.sh stands up in-cluster ES Services; override each URL to the
-          # matching plaintext in-cluster Service. license/public-key are pointed at sc4es-license
-          # for the multi-sidecar tier.
+          # matching plaintext in-cluster Service. The licence Secret is pointed at sc4es-license
+          # for the multi-sidecar tier. NOTE: --set license.publicKeySecretName would now ABORT
+          # the render by design (the chart fails on it as of appVersion 0.3.0).
           extra=""
           if [ "${{ matrix.license }}" = "true" ]; then
-            extra="--set license.secretName=sc4es-license --set license.publicKeySecretName=sc4es-license"
+            extra="--set license.secretName=sc4es-license"
           fi
           # The three-region/heterogeneous examples set sidecars[].auth.method=bearer pointing at
           # per-region sc4es-arrow-* Secrets that this CI does NOT create (the dedicated
@@ -447,12 +468,12 @@ jobs:
         run: sudo sysctl -w vm.max_map_count=262144
       - name: Skip if examples missing or no Pro test license (FACT C + FACT F)
         id: guard
-        # Upgrade ends at 3 clusters → same Pro gate as install-topology: JWT secret AND
-        # public-key secret (+ the published image must be Pro-capable, 16.1 OQ-5).
+        # Upgrade ends at 3 clusters → same Pro gate as install-topology: the JWT secret
+        # (+ the published image must be Pro-capable, 16.1 OQ-5).
         run: |
           if [ ! -f "${CHART_DIR}/examples/single-cluster/values.yaml" ] || [ ! -f "${CHART_DIR}/examples/three-region/values.yaml" ] \
-             || [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ] || [ -z "${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" ]; then
-            echo "::warning::upgrade test needs both examples (16.4) + SC4ES_PRO_TEST_JWT + SC4ES_TEST_PUBLIC_KEY (and a Pro-capable image, FACT F); skipping"
+             || [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ]; then
+            echo "::warning::upgrade test needs both examples (16.4) + SC4ES_PRO_TEST_JWT (and a Pro-capable image, FACT F); skipping"
             echo "skip=true" >> "$GITHUB_OUTPUT"
           fi
       - name: Set up Helm
@@ -478,8 +499,7 @@ jobs:
           ./.github/scripts/deploy-es.sh secrets '8'
           for n in sc4es-license sc4es-pro-license; do
             kubectl create secret generic "$n" \
-              --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" \
-              --from-literal=license-public-key="${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" || true
+              --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" || true
           done
           helm install fed "${CHART_DIR}" -f "${CHART_DIR}/examples/single-cluster/values.yaml" \
             ${TEST_ADBC_IMAGE:+--set test.image=$TEST_ADBC_IMAGE} \
@@ -493,7 +513,7 @@ jobs:
           # + catalog count, not the per-region bearer Secrets (which it does not create).
           helm upgrade fed "${CHART_DIR}" -f "${CHART_DIR}/examples/three-region/values.yaml" \
             ${TEST_ADBC_IMAGE:+--set test.image=$TEST_ADBC_IMAGE} \
-            --set license.secretName=sc4es-license --set license.publicKeySecretName=sc4es-license \
+            --set license.secretName=sc4es-license \
             --set sidecars[0].elasticsearch.url=http://es-us-east-1:9200 \
             --set sidecars[1].elasticsearch.url=http://es-eu-west-1:9200 \
             --set sidecars[2].elasticsearch.url=http://es-ap-south-1:9200 \
diff --git a/softclient4es-federation/Chart.yaml b/softclient4es-federation/Chart.yaml
index ce587bf..f4a9893 100644
--- a/softclient4es-federation/Chart.yaml
+++ b/softclient4es-federation/Chart.yaml
@@ -43,12 +43,28 @@ type: application
 #        #141, a real health probe #146, and the server images ship a default
 #        logback.xml so they no longer boot at ROOT DEBUG #138), rolled into the
 #        federation + sidecar images.
-version: 0.3.5
+# 0.3.6: appVersion 0.3.0 — elasticsql 0.21.0 (sliced PIT row extraction #238:
+#        one reader per primary shard, merged into a single stream, with a new
+#        `elastic.scroll { size, max-slices }` HOCON surface and ELASTIC_SCROLL_*
+#        env overrides; row order of an un-ordered extraction now INTERLEAVES
+#        across slices, and a quota-capped result is an arbitrary subset)
+#        + extensions 0.3.0 + arrow 0.3.0 (the advertised-schema probe is
+#        bounded, so a LIMITed SELECT no longer hits Elasticsearch a second time
+#        softclient4es-arrow#163), rolled into the federation + sidecar images.
+#        BREAKING (chart): the licence trust root is now embedded in the image, so
+#        SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted. `license.
+#        publicKeySecretName` / `publicKeyKey` are retained ONLY to abort the render
+#        with an actionable message — a value that used to decide HOW a licence is
+#        verified must not decay into a silent no-op. Remove them from your values.
+#        A licence issued by the SoftClient4ES licence server verifies with no extra
+#        configuration, air-gapped clusters included; a self-signed JWT can no longer
+#        be made to verify by supplying its public key.
+version: 0.3.6
 # The federation application/image version this chart deploys by default.
 # Keep in sync with docker.io/softnetwork/softclient4es-federation:<tag>.
 # Verified published on DockerHub for the federation image AND all four
 # softclient4es{6,7,8,9}-arrow-flight-sql sidecar images.
-appVersion: "0.2.5"
+appVersion: "0.3.0"
 keywords:
   - elasticsearch
   - flight-sql
diff --git a/softclient4es-federation/README.md b/softclient4es-federation/README.md
index 78a8427..7c2c4c6 100644
--- a/softclient4es-federation/README.md
+++ b/softclient4es-federation/README.md
@@ -88,8 +88,8 @@ helm uninstall fed
 | `federation.upgradeUrl` | `https://portal.softclient4es.com/pricing` | `FEDERATION_UPGRADE_URL`. |
 | `telemetry.enabled` | `true` | `SOFTCLIENT4ES_TELEMETRY_ENABLED` daily-ping opt-out (`false` opts out). |
 | `license.secretName` | `""` | Secret holding license/API key; empty = Community. |
-| `license.publicKeySecretName` | `""` | Secret holding the Ed25519 public JWK for OFFLINE license verification → `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`; empty = use JWKS fetch. |
-| `license.publicKeyKey` | `license-public-key` | Data key within `license.publicKeySecretName`. |
+| `license.publicKeySecretName` | `""` | **Removed in appVersion 0.3.0** — the trust root is embedded in the image. Setting it aborts the render. Leave empty. |
+| `license.publicKeyKey` | `""` | **Removed in appVersion 0.3.0** — see above. Leave empty. |
 | `service.type` | `ClusterIP` | Service type. |
 | `service.port` | `32020` | `FEDERATION_PORT` (Flight SQL); the only port exposed by the Service. |
 | `resources` | req `1Gi`/`500m`, lim `2Gi`/`1000m` | Container resource requests/limits. |
@@ -194,12 +194,11 @@ The test Pod defaults to `python:3.12-slim` and `pip install`s the ADBC driver a
 with `--set test.image=<image>` (and `--set test.adbcVersion=<v>` to control the driver version
 when the runtime install IS used). This is the same Job CI runs.
 
-> **Offline license verification (`license.publicKeySecretName`).** When the federation must
-> verify a license JWT WITHOUT reaching the license server's JWKS endpoint (air-gapped clusters,
-> or a JWT whose `kid` is not in the prod JWKS), set `license.publicKeySecretName` to a Secret
-> whose `license.publicKeyKey` data key holds the matching Ed25519 public JWK. It is mounted as
-> `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` (the air-gap path in the license verifier). Leave empty (the
-> default) to use the normal JWKS fetch — it renders nothing, so the golden render is unaffected.
+> **Offline license verification (appVersion 0.3.0 and later).** Nothing to configure. The
+> licence trust root is embedded in the image, so a licence issued by the SoftClient4ES licence
+> server verifies with no network access and no extra values — air-gapped clusters included.
+> `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` is no longer consulted, and `license.publicKeySecretName`
+> now **aborts the render** rather than becoming a silent no-op. Remove it from your values.
 
 ## Secrets, TLS & Ingress
 
@@ -372,9 +371,9 @@ than fail — the static-validation gates run unconditionally on every PR with z
 
 \* The multi-cluster (Pro) tiers run only when ALL of: (1) the federation image bundles the
 JWT-verifying SPI (a **Pro-capable** image — an OSS-only image ships only the Community SPI and
-cannot verify ANY Pro JWT), (2) the `SC4ES_PRO_TEST_JWT` repo secret, and (3) the
-`SC4ES_TEST_PUBLIC_KEY` repo secret (injected as `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` via
-`license.publicKeySecretName` so the JWT verifies offline) are present. Otherwise they are
+cannot verify ANY Pro JWT), and (2) the `SC4ES_PRO_TEST_JWT` repo secret, holding a JWT **issued
+by the SoftClient4ES licence server** (since appVersion 0.3.0 a self-signed test JWT can no longer
+be made to verify by supplying its public key) are present. Otherwise they are
 **skipped with a CI annotation** (not a failure). A **single-cluster** federation is license-FREE
 (Community `maxClusters=1`) and is always tested; the static three-region/heterogeneous golden
 proves the mixed-version RENDER on every PR even when the live multi-cluster install is skipped.
@@ -397,7 +396,7 @@ failed. The golden gate renders with NO `--set image.tag`.
 | `kubeconform` invalid resource | a manifest field renamed/typo (e.g. `replicaCount` vs `replicas`) | fix the template; `replicas` is the Deployment field |
 | `heterogeneous-ready` discriminator fails | `three-region` and `heterogeneous-ready` overlays drifted (one copied over the other) | restore the commented R2b `duckdb-attach` preview in `heterogeneous-ready` (the goldens are byte-identical — this grep is the only signal) |
 | federation pod CrashLoopBackOff (3 sidecars, license supplied but Community at runtime) | the image lacks the JWT SPI — it cannot verify the Pro JWT → falls back to Community → `maxClusters=1` exceeded | use a Pro-CAPABLE federation image (JWT SPI on classpath, 16.1 OQ-5); injecting a JWT into an OSS-only image does nothing |
-| federation pod CrashLoopBackOff (`InvalidLicense: Unknown key ID: …`) | the JWT verification key didn't resolve (no JWKS entry for the kid AND no `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`) | set `license.publicKeySecretName` → `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` (the offline verifier path), or ensure the license-server JWKS carries the kid |
+| federation pod CrashLoopBackOff (`InvalidLicense: Unknown key ID: …`) | the JWT was not signed by a key this image trusts — as of appVersion 0.3.0 the trust root is embedded, so a self-signed or test-signed JWT can no longer be made to verify | use a licence issued by the SoftClient4ES licence server. Supplying a public key is no longer possible and `license.publicKeySecretName` now aborts the render |
 | federation pod CrashLoopBackOff (3 sidecars, no license at all) | Community `maxClusters=1` exceeded | supply a Pro/Enterprise license (`license.secretName`) — by design |
 | federation pod CrashLoopBackOff (`validate()` / `FlightCredentials`) | Secret-backed cred didn't arrive (wrong key / ESO sync lag) | check the Secret exists + keys match the contract table above; self-heals on next restart |
 | federation NotReady, smoke connect-refused | a sidecar's backing ES is down/unreachable (all-or-nothing gRPC readiness) | ensure every sidecar's ES is reachable; or set `federation.probes.useGrpc=false` for partial availability |
diff --git a/softclient4es-federation/docs/operator-guide.md b/softclient4es-federation/docs/operator-guide.md
index 35e9d91..40c2699 100644
--- a/softclient4es-federation/docs/operator-guide.md
+++ b/softclient4es-federation/docs/operator-guide.md
@@ -116,7 +116,7 @@ See [`examples/heterogeneous-ready/README.md`](../examples/heterogeneous-ready/R
 | `federation.probes.useGrpc` | — (probe wiring) | — | true |
 | `federation.tls.{enabled,secretName}` | — (Ingress) | — | false |
 | `ingress.{enabled,className,annotations,hosts,tls}` | — (Ingress) | — | false |
-| `license.publicKeySecretName` (+ `license.publicKeyKey`) | — | `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` | `""` / `license-public-key` |
+| `license.publicKeySecretName` (+ `license.publicKeyKey`) | — | *(removed in appVersion 0.3.0 — setting it aborts the render)* | `""` / `""` |
 
 **Sidecar** (per `sidecars[]`; image auto-selected by `elasticsearchVersion`; HOCON root `arrow.flight.*` + elasticsql core `elastic.credentials.*`):
 
@@ -170,7 +170,7 @@ The federation reads its license from a referenced Secret as `SOFTCLIENT4ES_LICE
 
 Exceeding the quota → the federation logs the over-quota error and `sys.exit(1)` → **CrashLoopBackOff by design** (see §10). Federation is NOT a paid feature — single-cluster is the free adoption tier; the quota is on *cluster count*. To opt out of the daily anonymous usage ping, set `telemetry.enabled: false` (→ `SOFTCLIENT4ES_TELEMETRY_ENABLED=false`); this has zero impact on functionality or your license.
 
-> **Offline verification.** For air-gapped or strict-egress clusters, mount the Ed25519 public JWK via `license.publicKeySecretName` (key `license.publicKeyKey`, default `license-public-key`) → `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`. This lets the federation verify a Pro/Enterprise JWT entirely offline (no portal round-trip). It is gated independently of `license.secretName`.
+> **Offline verification.** Nothing to configure as of appVersion 0.3.0. The licence trust root is embedded in the image, so a Pro/Enterprise licence issued by the SoftClient4ES licence server verifies entirely offline — air-gapped and strict-egress clusters included — with no portal round-trip and no public key to mount. `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` is no longer consulted, and `license.publicKeySecretName` now aborts the render instead of silently doing nothing.
 
 ## 8. ES-version mixing & migration
 
diff --git a/softclient4es-federation/examples/three-region/README.md b/softclient4es-federation/examples/three-region/README.md
index caaf28c..3af89aa 100644
--- a/softclient4es-federation/examples/three-region/README.md
+++ b/softclient4es-federation/examples/three-region/README.md
@@ -29,10 +29,10 @@ kubectl create secret generic sc4es-pro-license --from-literal=license-key="$SC4
 > bundled ONLY in the Pro/Enterprise-capable federation image. The Community/OSS image
 > ships only the Community license manager, so it ignores any injected JWT, resolves to
 > Community (`maxClusters=1`), and **still CrashLoops** on this 3-cluster example. The
-> image must ALSO be able to resolve the license SIGNING public key offline (env
-> `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`, or the issuer's JWKS endpoint must be reachable).
-> Use a Pro/Enterprise-entitled federation image + provision the public key; consult the
-> licensing/operator guide for the exact image + key provisioning. This precondition is
+> As of appVersion 0.3.0 the signing trust root is embedded in the image, so no key needs
+> provisioning — but the JWT must be one the SoftClient4ES licence server issued.
+> Use a Pro/Enterprise-entitled federation image; consult the licensing/operator guide for
+> the exact image. This precondition is
 > tracked for the CI/install path (Story 16.5 FACT F / Story 16.1 OQ-5). A bare
 > `--set image.tag` of the OSS snapshot image WILL CrashLoop even with a valid JWT Secret.
 
diff --git a/softclient4es-federation/templates/deployment.yaml b/softclient4es-federation/templates/deployment.yaml
index 5e5cbe2..49ff5da 100644
--- a/softclient4es-federation/templates/deployment.yaml
+++ b/softclient4es-federation/templates/deployment.yaml
@@ -3,6 +3,15 @@
        CONFIG_FORCE_* credential env from the SAME Secret the sidecar reads. */ -}}
 {{- $secretAuth := false }}
 {{- range $s := .Values.sidecars }}{{- if and $s.auth (ne (lower (default "none" $s.auth.method)) "none") $s.auth.credentialsSecretName }}{{- $secretAuth = true }}{{- end }}{{- end }}
+{{- /* appVersion 0.3.0: the licence trust root is now embedded in the image and
+       SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted. This value used to decide
+       HOW a licence was verified, so quietly dropping it would leave an operator believing
+       an offline key is still in force. Fail the render instead, so it surfaces at
+       `helm upgrade` rather than as a CrashLoopBackOff. Nothing fires at the "" default,
+       so every committed golden stays byte-stable. */ -}}
+{{- if .Values.license.publicKeySecretName }}
+{{- fail "license.publicKeySecretName is no longer supported: as of appVersion 0.3.0 the licence trust root is embedded in the image, and SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is ignored. Remove license.publicKeySecretName (and license.publicKeyKey). A licence issued by the SoftClient4ES licence server verifies with no extra configuration." }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -78,19 +87,6 @@ spec:
                   key: {{ .Values.license.apiKeyKey | default "api-key" }}
                   optional: true
             {{- end }}
-            {{- /* Story 16.5 (FACT F #2): offline license public-key for air-gapped /
-                   test-signed JWT verification (LicenseKeyVerifier.loadPublicKey Step 3).
-                   Gated INDEPENDENTLY of license.secretName so the multi-sidecar CI can
-                   point it at the same Secret. Renders nothing at the "" default, so the
-                   golden and every example are byte-stable. */}}
-            {{- if .Values.license.publicKeySecretName }}
-            - name: SOFTCLIENT4ES_LICENSE_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.license.publicKeySecretName }}
-                  key: {{ .Values.license.publicKeyKey | default "license-public-key" }}
-                  optional: true
-            {{- end }}
             {{- if gt (len .Values.sidecars) 0 }}
             # Point Typesafe Config at the mounted ConfigMap so ConfigFactory.load()
             # picks up the `servers` map (which has NO env override). The native-packager
diff --git a/softclient4es-federation/tests/golden/default.yaml b/softclient4es-federation/tests/golden/default.yaml
index 37c1884..0c80b42 100644
--- a/softclient4es-federation/tests/golden/default.yaml
+++ b/softclient4es-federation/tests/golden/default.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -44,10 +44,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -60,10 +60,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
@@ -78,7 +78,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml b/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml
index 22754fe..7ad0672 100644
--- a/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml
+++ b/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: ConfigMap
 metadata:
   name: fed-softclient4es-federation-config
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -84,10 +84,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -108,12 +108,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-us-east-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: us-east-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -135,12 +135,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-eu-west-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: eu-west-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -162,12 +162,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-ap-south-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: ap-south-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -189,10 +189,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -205,17 +205,17 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
       annotations:
         # Roll the federation Pod whenever the rendered servers ConfigMap changes
         # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect.
-        checksum/config: f814c5bf194d000857da84ae0b4b94f77041021b26407b0879e256a5f7f1dc06
+        checksum/config: c1c2ef1ac349925f16819a12b41899c413dd877a767257867addefee5f405a52
     spec:
       serviceAccountName: fed-softclient4es-federation
       securityContext:
@@ -227,7 +227,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -359,12 +359,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-us-east-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: us-east-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -378,12 +378,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: us-east-1
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -397,7 +397,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -549,12 +549,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-eu-west-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: eu-west-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -568,12 +568,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: eu-west-1
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -587,7 +587,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -739,12 +739,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-ap-south-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: ap-south-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -758,12 +758,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: ap-south-1
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -777,7 +777,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -929,10 +929,10 @@ kind: Pod
 metadata:
   name: fed-softclient4es-federation-test-catalogs
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
diff --git a/softclient4es-federation/tests/golden/example-single-cluster.yaml b/softclient4es-federation/tests/golden/example-single-cluster.yaml
index 6705ccd..be0c8a8 100644
--- a/softclient4es-federation/tests/golden/example-single-cluster.yaml
+++ b/softclient4es-federation/tests/golden/example-single-cluster.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: ConfigMap
 metadata:
   name: fed-softclient4es-federation-config
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -49,10 +49,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -73,12 +73,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-primary
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: primary
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -100,10 +100,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -116,17 +116,17 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
       annotations:
         # Roll the federation Pod whenever the rendered servers ConfigMap changes
         # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect.
-        checksum/config: 4eddee3a366f96b211e7f8fc5c3c46217c722cc447dedae7c13ec9d836a1c432
+        checksum/config: 836802080cd49217ebf335ad3a77fee4443ab02e72eeb0a7104c278c1a262dc4
     spec:
       serviceAccountName: fed-softclient4es-federation
       securityContext:
@@ -138,7 +138,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -240,12 +240,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-primary
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: primary
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -259,12 +259,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: primary
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -278,7 +278,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -394,10 +394,10 @@ kind: Pod
 metadata:
   name: fed-softclient4es-federation-test-catalogs
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
diff --git a/softclient4es-federation/tests/golden/example-three-region.yaml b/softclient4es-federation/tests/golden/example-three-region.yaml
index 22754fe..7ad0672 100644
--- a/softclient4es-federation/tests/golden/example-three-region.yaml
+++ b/softclient4es-federation/tests/golden/example-three-region.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: ConfigMap
 metadata:
   name: fed-softclient4es-federation-config
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -84,10 +84,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -108,12 +108,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-us-east-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: us-east-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -135,12 +135,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-eu-west-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: eu-west-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -162,12 +162,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-ap-south-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: ap-south-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -189,10 +189,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -205,17 +205,17 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
       annotations:
         # Roll the federation Pod whenever the rendered servers ConfigMap changes
         # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect.
-        checksum/config: f814c5bf194d000857da84ae0b4b94f77041021b26407b0879e256a5f7f1dc06
+        checksum/config: c1c2ef1ac349925f16819a12b41899c413dd877a767257867addefee5f405a52
     spec:
       serviceAccountName: fed-softclient4es-federation
       securityContext:
@@ -227,7 +227,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -359,12 +359,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-us-east-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: us-east-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -378,12 +378,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: us-east-1
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -397,7 +397,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -549,12 +549,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-eu-west-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: eu-west-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -568,12 +568,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: eu-west-1
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -587,7 +587,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -739,12 +739,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-ap-south-1
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: ap-south-1
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -758,12 +758,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: ap-south-1
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -777,7 +777,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -929,10 +929,10 @@ kind: Pod
 metadata:
   name: fed-softclient4es-federation-test-catalogs
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
diff --git a/softclient4es-federation/tests/golden/ingress-tls.yaml b/softclient4es-federation/tests/golden/ingress-tls.yaml
index 70e10b7..528221c 100644
--- a/softclient4es-federation/tests/golden/ingress-tls.yaml
+++ b/softclient4es-federation/tests/golden/ingress-tls.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: ConfigMap
 metadata:
   name: fed-softclient4es-federation-config
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -49,10 +49,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -73,12 +73,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-prod-us
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-us
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -100,10 +100,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -116,17 +116,17 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
       annotations:
         # Roll the federation Pod whenever the rendered servers ConfigMap changes
         # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect.
-        checksum/config: efa831fb157f8c40d9037ce2f518332a6d7429014630e4fb33defe62a0d74240
+        checksum/config: 763da5d4fd22cd5365b7075c0eaa9351c7995285cb6c231ccb8e2a76d74b3a98
     spec:
       serviceAccountName: fed-softclient4es-federation
       securityContext:
@@ -138,7 +138,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -240,12 +240,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-prod-us
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-us
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -259,12 +259,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: prod-us
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -278,7 +278,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -362,10 +362,10 @@ kind: Ingress
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -401,10 +401,10 @@ kind: Pod
 metadata:
   name: fed-softclient4es-federation-test-catalogs
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
diff --git a/softclient4es-federation/tests/golden/secret-auth.yaml b/softclient4es-federation/tests/golden/secret-auth.yaml
index 00e2ffe..d69162b 100644
--- a/softclient4es-federation/tests/golden/secret-auth.yaml
+++ b/softclient4es-federation/tests/golden/secret-auth.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: ConfigMap
 metadata:
   name: fed-softclient4es-federation-config
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -58,10 +58,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -82,12 +82,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-prod-us
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-us
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -109,10 +109,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -125,17 +125,17 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
       annotations:
         # Roll the federation Pod whenever the rendered servers ConfigMap changes
         # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect.
-        checksum/config: 50d761219cc3ad4854d09c55768918608bf0f94aab623aebb2124ba061111804
+        checksum/config: 0c6c87ce340dc0d637cc004a129a0b4881d61d2cdb37f2a9260e79fd862f3383
     spec:
       serviceAccountName: fed-softclient4es-federation
       securityContext:
@@ -147,7 +147,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -255,12 +255,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-prod-us
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-us
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -274,12 +274,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: prod-us
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -293,7 +293,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -433,10 +433,10 @@ kind: Pod
 metadata:
   name: fed-softclient4es-federation-test-catalogs
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
diff --git a/softclient4es-federation/tests/golden/two-sidecars.yaml b/softclient4es-federation/tests/golden/two-sidecars.yaml
index 64ee42c..71f3a82 100644
--- a/softclient4es-federation/tests/golden/two-sidecars.yaml
+++ b/softclient4es-federation/tests/golden/two-sidecars.yaml
@@ -5,10 +5,10 @@ kind: ServiceAccount
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -20,10 +20,10 @@ kind: ConfigMap
 metadata:
   name: fed-softclient4es-federation-config
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -53,10 +53,10 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -77,12 +77,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-prod-us
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-us
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -104,12 +104,12 @@ kind: Service
 metadata:
   name: fed-softclient4es-federation-prod-eu
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-eu
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -131,10 +131,10 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
@@ -147,17 +147,17 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: federation
         app.kubernetes.io/part-of: softclient4es
       annotations:
         # Roll the federation Pod whenever the rendered servers ConfigMap changes
         # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect.
-        checksum/config: 4301553f05eaeaddc68ed4ebb4deaef0eb3b2d822a89d770fe49c86342921f7d
+        checksum/config: 4d15952118ec4dd9cf322390ec134005f6e3385bf78b15ee28250c7aa94f6357
     spec:
       serviceAccountName: fed-softclient4es-federation
       securityContext:
@@ -169,7 +169,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: federation
-          image: "docker.io/softnetwork/softclient4es-federation:0.2.5"
+          image: "docker.io/softnetwork/softclient4es-federation:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -283,12 +283,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-prod-us
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-us
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -302,12 +302,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: prod-us
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -321,7 +321,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -447,12 +447,12 @@ kind: Deployment
 metadata:
   name: fed-softclient4es-federation-prod-eu
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
     app.kubernetes.io/component: sidecar
     softclient4es.app/sidecar: prod-eu
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: softclient4es
 spec:
@@ -466,12 +466,12 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: softclient4es-federation-0.3.5
+        helm.sh/chart: softclient4es-federation-0.3.6
         app.kubernetes.io/name: softclient4es-federation
         app.kubernetes.io/instance: fed
         app.kubernetes.io/component: sidecar
         softclient4es.app/sidecar: prod-eu
-        app.kubernetes.io/version: "0.2.5"
+        app.kubernetes.io/version: "0.3.0"
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/part-of: softclient4es
     spec:
@@ -485,7 +485,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: sidecar
-          image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.2.5"
+          image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.3.0"
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false
@@ -611,10 +611,10 @@ kind: Pod
 metadata:
   name: fed-softclient4es-federation-test-catalogs
   labels:
-    helm.sh/chart: softclient4es-federation-0.3.5
+    helm.sh/chart: softclient4es-federation-0.3.6
     app.kubernetes.io/name: softclient4es-federation
     app.kubernetes.io/instance: fed
-    app.kubernetes.io/version: "0.2.5"
+    app.kubernetes.io/version: "0.3.0"
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: federation
     app.kubernetes.io/part-of: softclient4es
diff --git a/softclient4es-federation/values.yaml b/softclient4es-federation/values.yaml
index 9882140..815e462 100644
--- a/softclient4es-federation/values.yaml
+++ b/softclient4es-federation/values.yaml
@@ -115,16 +115,17 @@ license:
   secretName: ""
   licenseKeyKey: license-key    # Secret data key holding the JWT license -> SOFTCLIENT4ES_LICENSE_KEY
   apiKeyKey: api-key            # Secret data key holding the API key      -> SOFTCLIENT4ES_API_KEY
-  # ── Offline license public-key (Story 16.5, FACT F #2) ────────────────────────
-  # OPTIONAL. When the federation must verify a license JWT WITHOUT reaching the
-  # license server's JWKS endpoint (air-gapped clusters, or a test-signed JWT whose
-  # `kid` is not in the prod JWKS), point publicKeySecretName at a Secret whose
-  # `publicKeyKey` data key holds the matching Ed25519 public JWK. It is mounted as
-  # SOFTCLIENT4ES_LICENSE_PUBLIC_KEY — the air-gap path in LicenseKeyVerifier.loadPublicKey
-  # (Step 3, VERIFIED). Leave empty (the default) to use the normal JWKS fetch. Renders
-  # NOTHING when empty, so the golden render and every shipped example are unaffected.
+  # ── Offline license public-key — REMOVED in appVersion 0.3.0 ─────────────────
+  # The licence trust root is now embedded in the image, so a licence issued by the
+  # SoftClient4ES licence server verifies with NO extra configuration, air-gapped or
+  # not. SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted.
+  #
+  # These keys are retained ONLY so the chart can fail loudly if they are still set:
+  # a value that used to change how a licence is verified must not become a silent
+  # no-op. Setting publicKeySecretName aborts the render with an actionable message.
+  # Leave both empty.
   publicKeySecretName: ""
-  publicKeyKey: license-public-key   # Secret data key holding the Ed25519 public JWK -> SOFTCLIENT4ES_LICENSE_PUBLIC_KEY
+  publicKeyKey: ""
 
 service:
   type: ClusterIP