diff --git a/charts/drupal/templates/_helpers.tpl b/charts/drupal/templates/_helpers.tpl
index 1bd75fa99..2f0605ff5 100644
--- a/charts/drupal/templates/_helpers.tpl
+++ b/charts/drupal/templates/_helpers.tpl
@@ -371,3 +371,22 @@ Backup database username.
 {{- include "drupal.databaseUsername" . -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Central fail-fast validation entrypoint.
+*/}}
+{{- define "drupal.validate" -}}
+{{- $_ := include "drupal.databaseMode" . -}}
+{{- $_ := include "drupal.replicaCount" . -}}
+{{- $_ := include "drupal.backupEnabled" . -}}
+{{- $_ := include "drupal.autoscalingEnabled" . -}}
+{{- if and .Values.ingress.enabled (not .Values.ingress.hosts) -}}
+{{- fail "ingress.hosts must contain at least one rule when ingress.enabled=true" -}}
+{{- end -}}
+{{- $podLabels := .Values.podLabels | default dict -}}
+{{- range list "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" -}}
+{{- if hasKey $podLabels . -}}
+{{- fail (printf "podLabels must not override selector label %s" .) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/drupal/templates/validate.yaml b/charts/drupal/templates/validate.yaml
new file mode 100644
index 000000000..7edf83b22
--- /dev/null
+++ b/charts/drupal/templates/validate.yaml
@@ -0,0 +1,2 @@
+{{/* SPDX-License-Identifier: Apache-2.0 */}}
+{{- include "drupal.validate" . -}}
diff --git a/charts/drupal/tests/validation_test.yaml b/charts/drupal/tests/validation_test.yaml
index 4874eb7da..8fdf82eb8 100644
--- a/charts/drupal/tests/validation_test.yaml
+++ b/charts/drupal/tests/validation_test.yaml
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 suite: Validations
 templates:
-  - templates/deployment.yaml
+  - templates/validate.yaml
 release:
   name: test
   namespace: default
@@ -35,3 +35,41 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "database.mode=sqlite requires drupal.sqlitePath to stay under sites/ so persistence and backup cover the database file"
+
+  - it: should fail ingress without rules
+    set:
+      ingress.enabled: true
+      ingress.hosts: []
+    asserts:
+      - failedTemplate:
+          errorMessage: "ingress.hosts must contain at least one rule when ingress.enabled=true"
+
+  - it: should fail reserved pod label overrides
+    set:
+      podLabels:
+        app.kubernetes.io/component: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override selector label app.kubernetes.io/component"
+
+  - it: should fail reserved app name label overrides
+    set:
+      podLabels:
+        app.kubernetes.io/name: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override selector label app.kubernetes.io/name"
+
+  - it: should fail reserved app instance label overrides
+    set:
+      podLabels:
+        app.kubernetes.io/instance: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: "podLabels must not override selector label app.kubernetes.io/instance"
+
+  - it: should allow null pod labels
+    set:
+      podLabels: null
+    asserts:
+      - notFailedTemplate: {}