diff --git a/charts/oecs-hub/Chart.yaml b/charts/oecs-hub/Chart.yaml
index ae4737b..d174104 100644
--- a/charts/oecs-hub/Chart.yaml
+++ b/charts/oecs-hub/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: oecs-hub
 description: OECS hub - gRPC registry service for EV charger/manufacturer data
 type: application
-version: 0.1.5
-appVersion: "0.7.0"
+version: 0.1.6
+appVersion: "0.11.0"
 kubeVersion: ">=1.27.0-0"
 home: https://github.com/ChargePi/oecs-registry
 sources:
diff --git a/charts/oecs-hub/templates/_helpers.tpl b/charts/oecs-hub/templates/_helpers.tpl
index 98ca47e..2c927f6 100644
--- a/charts/oecs-hub/templates/_helpers.tpl
+++ b/charts/oecs-hub/templates/_helpers.tpl
@@ -114,6 +114,7 @@ Remaining sensitive env vars (redis/memgraph/profiling), always sourced per the
 {{ include "oecs-hub.secretEnv" (dict "envName" "OECS_HUB_OBSERVABILITY_PROFILING_PASSWORD" "spec" .Values.secrets.profiling.password "defaultSecretName" (include "oecs-hub.secretName" .)) }}
 {{ include "oecs-hub.secretEnv" (dict "envName" "OECS_HUB_OBSERVABILITY_PROFILING_AUTHTOKEN" "spec" .Values.secrets.profiling.authToken "defaultSecretName" (include "oecs-hub.secretName" .)) }}
 {{ include "oecs-hub.secretEnv" (dict "envName" "OECS_HUB_AUTH_GATEWAY_SECRET" "spec" .Values.secrets.auth.gatewaySecret "defaultSecretName" (include "oecs-hub.secretName" .)) }}
+{{ include "oecs-hub.secretEnv" (dict "envName" "OECS_HUB_BIFROST_APIKEY" "spec" .Values.secrets.bifrost.apiKey "defaultSecretName" (include "oecs-hub.secretName" .)) }}
 {{- end -}}
 
 {{/*
diff --git a/charts/oecs-hub/templates/configmap.yaml b/charts/oecs-hub/templates/configmap.yaml
index ebc3e7f..d8a1d86 100644
--- a/charts/oecs-hub/templates/configmap.yaml
+++ b/charts/oecs-hub/templates/configmap.yaml
@@ -20,6 +20,13 @@ data:
       address: {{ include "oecs-hub.memgraphAddress" . | quote }}
     kratos:
       adminUrl: {{ .Values.kratos.adminUrl | quote }}
+    bifrost:
+      baseUrl: {{ .Values.bifrost.baseUrl | quote }}
+      model: {{ .Values.bifrost.model | quote }}
+    promptSuggestions:
+      refreshInterval: {{ .Values.config.promptSuggestions.refreshInterval | quote }}
+      poolSize: {{ .Values.config.promptSuggestions.poolSize }}
+      returnCount: {{ .Values.config.promptSuggestions.returnCount }}
     observability:
       logging:
         level: {{ .Values.config.observability.logging.level | quote }}
diff --git a/charts/oecs-hub/templates/secret.yaml b/charts/oecs-hub/templates/secret.yaml
index 69a6bab..410c4be 100644
--- a/charts/oecs-hub/templates/secret.yaml
+++ b/charts/oecs-hub/templates/secret.yaml
@@ -21,6 +21,9 @@
 {{- if and $secrets.profiling.authToken.value (not $secrets.profiling.authToken.existingSecret) }}
 {{- $_ := set $data $secrets.profiling.authToken.existingSecretKey $secrets.profiling.authToken.value }}
 {{- end }}
+{{- if and $secrets.bifrost.apiKey.value (not $secrets.bifrost.apiKey.existingSecret) }}
+{{- $_ := set $data $secrets.bifrost.apiKey.existingSecretKey $secrets.bifrost.apiKey.value }}
+{{- end }}
 {{- if $data }}
 apiVersion: v1
 kind: Secret
diff --git a/charts/oecs-hub/values.yaml b/charts/oecs-hub/values.yaml
index e8fb7b3..994342c 100644
--- a/charts/oecs-hub/values.yaml
+++ b/charts/oecs-hub/values.yaml
@@ -128,6 +128,14 @@ config:
     profiling:
       enabled: false
       address: ""
+  # Chat empty state's suggested-prompt chips (internal/promptsuggestion).
+  promptSuggestions:
+    # How long a topic's cached pool stays fresh before the next request regenerates it.
+    refreshInterval: 30m
+    # How many distinct suggestions are generated and cached per topic on each regeneration.
+    poolSize: 10
+    # How many of a topic's cached pool are randomly sampled and returned per request.
+    returnCount: 1
 
 ## -- Sensitive values. Each field supports either an inline `value` (chart creates/owns a
 ## Secret key for it) or `existingSecret`/`existingSecretKey` to source it from a Secret you
@@ -174,6 +182,13 @@ secrets:
       value: ""
       existingSecret: ""
       existingSecretKey: "gateway-secret"
+  bifrost:
+    # Bifrost virtual key (sk-bf-...), sent as the Bearer token. Leave empty if Bifrost
+    # governance is disabled.
+    apiKey:
+      value: ""
+      existingSecret: ""
+      existingSecretKey: "bifrost-api-key"
 
 ## -- Auth edge: proves a request was routed through Traefik/Oathkeeper (see
 ## secrets.auth.gatewaySecret above) and where to look up identity traits
@@ -181,6 +196,13 @@ secrets:
 kratos:
   adminUrl: ""
 
+## -- Bifrost (OpenAI-API-compatible LLM gateway), used for prompt suggestions. Not bundled -
+## point baseUrl at an existing instance. API key lives under secrets.bifrost.apiKey. --
+bifrost:
+  baseUrl: "http://bifrost:8080/v1"
+  # Bifrost's "provider/model" form.
+  model: "gemini/gemini-3.1-flash-lite"
+
 ## -- PostgreSQL. When internal.enabled, a CloudNativePG `Cluster` is created and this chart
 ## automatically points the app at the generated `<fullname>-postgresql-app` Secret's `uri` key,
 ## ignoring secrets.database.dsn. When disabled, set secrets.database.dsn yourself. --