diff --git a/charts/automatisch/templates/_helpers.tpl b/charts/automatisch/templates/_helpers.tpl
index 548e31547..5c2fc4ae5 100644
--- a/charts/automatisch/templates/_helpers.tpl
+++ b/charts/automatisch/templates/_helpers.tpl
@@ -39,6 +39,34 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 {{- end -}}
 
+{{- define "automatisch.validate" -}}
+{{- if and (not .Values.postgresql.enabled) (not .Values.database.external.host) -}}
+{{- fail "database.external.host is required when postgresql.enabled is false" -}}
+{{- end -}}
+{{- if and (not .Values.postgresql.enabled) (not .Values.database.external.existingSecret) (not .Values.database.external.password) -}}
+{{- fail "database.external.password or database.external.existingSecret is required when postgresql.enabled is false" -}}
+{{- end -}}
+{{- if and (not .Values.redis.enabled) (not .Values.redis_config.external.host) -}}
+{{- fail "redis_config.external.host is required when redis.enabled is false" -}}
+{{- end -}}
+{{- if and .Values.ingress.enabled (not .Values.ingress.hosts) -}}
+{{- fail "ingress.enabled requires ingress.hosts to contain at least one host" -}}
+{{- end -}}
+{{- if .Values.ingress.enabled -}}
+{{- range $index, $host := .Values.ingress.hosts -}}
+{{- if not $host.host -}}
+{{- fail (printf "ingress.hosts[%d].host is required when ingress.enabled is true" $index) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $selectorLabels := include "automatisch.selectorLabels" . | fromYaml -}}
+{{- range $key, $_ := .Values.podLabels -}}
+{{- if hasKey $selectorLabels $key -}}
+{{- fail (printf "podLabels must not override selector label %q" $key) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "automatisch.image" -}}
 {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
 {{- end -}}
diff --git a/charts/automatisch/templates/validate.yaml b/charts/automatisch/templates/validate.yaml
new file mode 100644
index 000000000..0202b4d1c
--- /dev/null
+++ b/charts/automatisch/templates/validate.yaml
@@ -0,0 +1,2 @@
+{{/* SPDX-License-Identifier: Apache-2.0 */}}
+{{- include "automatisch.validate" . -}}
diff --git a/charts/automatisch/tests/validation_test.yaml b/charts/automatisch/tests/validation_test.yaml
new file mode 100644
index 000000000..ac1f2b686
--- /dev/null
+++ b/charts/automatisch/tests/validation_test.yaml
@@ -0,0 +1,67 @@
+# SPDX-License-Identifier: Apache-2.0
+suite: Validation
+templates:
+  - templates/validate.yaml
+tests:
+  - it: should render no validation manifest by default
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should fail when external database host is missing
+    set:
+      postgresql.enabled: false
+      database.external.password: secret
+    asserts:
+      - failedTemplate:
+          errorMessage: "database.external.host is required when postgresql.enabled is false"
+
+  - it: should fail when external database credentials are missing
+    set:
+      postgresql.enabled: false
+      database.external.host: postgres.example.com
+    asserts:
+      - failedTemplate:
+          errorMessage: "database.external.password or database.external.existingSecret is required when postgresql.enabled is false"
+
+  - it: should fail when external redis host is missing
+    set:
+      redis.enabled: false
+    asserts:
+      - failedTemplate:
+          errorMessage: "redis_config.external.host is required when redis.enabled is false"
+
+  - it: should fail when ingress is enabled without hosts
+    set:
+      ingress.enabled: true
+      ingress.hosts: []
+    asserts:
+      - failedTemplate:
+          errorMessage: "ingress.enabled requires ingress.hosts to contain at least one host"
+
+  - it: should fail when an ingress host entry has no hostname
+    set:
+      ingress.enabled: true
+      ingress.hosts:
+        - paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - failedTemplate:
+          errorMessage: "ingress.hosts[0].host is required when ingress.enabled is true"
+
+  - it: should fail when podLabels override selector labels
+    set:
+      podLabels:
+        app.kubernetes.io/name: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: 'podLabels must not override selector label "app.kubernetes.io/name"'
+
+  - it: should fail when podLabels override release selector label
+    set:
+      podLabels:
+        app.kubernetes.io/instance: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: 'podLabels must not override selector label "app.kubernetes.io/instance"'