diff --git a/deploy/helm/pieced-threema-gateway/Chart.yaml b/deploy/helm/pieced-threema-gateway/Chart.yaml
index 39c27e8..ab5719a 100644
--- a/deploy/helm/pieced-threema-gateway/Chart.yaml
+++ b/deploy/helm/pieced-threema-gateway/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: pieced-threema-gateway
 description: PieCed IT central Threema Gateway relay
 type: application
-version: 0.1.10
-appVersion: "0.1.10"
+version: 0.1.11
+appVersion: "0.1.11"
diff --git a/deploy/helm/pieced-threema-gateway/templates/deployment.yaml b/deploy/helm/pieced-threema-gateway/templates/deployment.yaml
index 88cb386..8af3dcf 100644
--- a/deploy/helm/pieced-threema-gateway/templates/deployment.yaml
+++ b/deploy/helm/pieced-threema-gateway/templates/deployment.yaml
@@ -43,6 +43,16 @@ spec:
               value: {{ .Values.openclawUrlTemplate | quote }}
             - name: FORWARD_TIMEOUT_MS
               value: {{ .Values.forwardTimeoutMs | quote }}
+            - name: FORWARD_URL_HOST_PATTERN
+              value: {{ .Values.forwardUrlHostPattern | quote }}
+            - name: MEDIA_TTL_SECONDS
+              value: {{ .Values.media.ttlSeconds | quote }}
+            - name: MEDIA_MAX_INBOUND_BYTES
+              value: {{ .Values.media.maxInboundBytes | int64 | quote }}
+            - name: MEDIA_MAX_OUTBOUND_BYTES
+              value: {{ .Values.media.maxOutboundBytes | int64 | quote }}
+            - name: MEDIA_STORE_MAX_BYTES
+              value: {{ .Values.media.storeMaxBytes | int64 | quote }}
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
diff --git a/deploy/helm/pieced-threema-gateway/templates/networkpolicy.yaml b/deploy/helm/pieced-threema-gateway/templates/networkpolicy.yaml
index 1592175..66c8eae 100644
--- a/deploy/helm/pieced-threema-gateway/templates/networkpolicy.yaml
+++ b/deploy/helm/pieced-threema-gateway/templates/networkpolicy.yaml
@@ -6,13 +6,15 @@
 #   1. The cluster Ingress controller (nginx-ingress) — for Threema webhooks
 #      hitting us through the LB.
 #   2. The portal namespace — calls /admin and reads /metrics.
-#   3. Tenant namespaces (managed by pieced-operator) — call /api/send.
+#   3. Tenant namespaces (managed by pieced-operator) — call /api/*.
+#   4. networkPolicy.extraClients namespaces (e.g. personal Hermes) — /api/*.
 #
 # Egress:
 #   - DNS (kube-system)
 #   - Threema Gateway: msgapi.threema.ch:443 (FQDN-pinned)
 #   - Postgres in same namespace
-#   - HTTPS to tenant OpenClaw services in tenant namespaces (port 18789)
+#   - HTTP to tenant OpenClaw services in tenant namespaces (port 18790)
+#   - HTTP to extraClients namespaces on their configured port
 # =============================================================================
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
@@ -50,6 +52,16 @@ spec:
         - ports:
             - port: "8080"
               protocol: TCP
+    {{- range .Values.networkPolicy.extraClients }}
+    # Extra client: {{ .namespace }}
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": {{ .namespace | quote }}
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    {{- end }}
   egress:
     # DNS — with the proxy interceptor on so toFQDNs rules below
     # actually work.
@@ -112,4 +124,14 @@ spec:
         - ports:
             - port: "18790"
               protocol: TCP
+    {{- range .Values.networkPolicy.extraClients }}
+    # Extra client delivery: {{ .namespace }} (targetPort of its Service)
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": {{ .namespace | quote }}
+      toPorts:
+        - ports:
+            - port: {{ .port | quote }}
+              protocol: TCP
+    {{- end }}
 {{- end }}
diff --git a/deploy/helm/pieced-threema-gateway/values.yaml b/deploy/helm/pieced-threema-gateway/values.yaml
index b6da259..04bd1d7 100644
--- a/deploy/helm/pieced-threema-gateway/values.yaml
+++ b/deploy/helm/pieced-threema-gateway/values.yaml
@@ -6,7 +6,7 @@ namespace: threema-gateway
 
 image:
   repository: registry.c5ai.ch/pieced/pieced-threema-gateway
-  tag: "0.1.10"
+  tag: "0.1.11"
   pullPolicy: IfNotPresent
 
 # Pull from registry.c5ai.ch — matches operator + portal pattern.
@@ -138,6 +138,20 @@ openclawUrlTemplate: http://openclaw.tenant-{tenant}.svc.cluster.local:18789/web
 
 forwardTimeoutMs: 8000
 
+# Per-tenant forward URLs (set via POST/PATCH /admin/tokens {forwardUrl})
+# must point at a cluster Service whose hostname matches this pattern.
+forwardUrlHostPattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?\.[a-z0-9]([-a-z0-9]*[a-z0-9])?\.svc(\.cluster\.local)?$'
+
+# Inbound media (voice notes, photos, files) for tenants with mediaEnabled.
+# Decrypted blobs are held in memory only, for ttlSeconds, until the tenant
+# plugin fetches them via GET /api/media/:id. Keep resources.limits.memory
+# comfortably above storeMaxBytes.
+media:
+  ttlSeconds: 600
+  maxInboundBytes: 26214400   # 25 MiB
+  maxOutboundBytes: 26214400  # 25 MiB
+  storeMaxBytes: 268435456    # 256 MiB
+
 logLevel: info
 
 # Resources for the relay pod
@@ -146,8 +160,9 @@ resources:
     cpu: 100m
     memory: 128Mi
   limits:
-    cpu: 500m
-    memory: 512Mi
+    cpu: "1"
+    # Media store (256 MiB) + one 25 MiB upload in flight as base64 JSON.
+    memory: 768Mi
 
 # CiliumNetworkPolicy — restricts who can talk in and out.
 networkPolicy:
@@ -159,3 +174,10 @@ networkPolicy:
   tenantNamespaceLabelValue: "pieced-operator"
   # The portal pod runs in this namespace (per apps/portal in pieced-gitops).
   portalNamespace: pieced-system
+  # Agents outside operator-managed tenant namespaces (e.g. a personal
+  # Hermes). Each entry allows that namespace to call the relay API and the
+  # relay to deliver to it on `port` (the pod's targetPort, see the note on
+  # Cilium socket-LB in templates/networkpolicy.yaml).
+  extraClients:
+    - namespace: hermes
+      port: 8650