diff --git a/charts/substrate/templates/ate-client.yaml b/charts/substrate/templates/ate-client.yaml
index 3de466a04..dfd2fdab6 100644
--- a/charts/substrate/templates/ate-client.yaml
+++ b/charts/substrate/templates/ate-client.yaml
@@ -14,7 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */}}
 
-{{- if eq .Values.auth.mode "jwt" }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -22,4 +21,3 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     apps: ate-client
-{{- end }}
diff --git a/charts/substrate/templates/ate-controller.yaml b/charts/substrate/templates/ate-controller.yaml
index 5c403837c..d144ad4de 100644
--- a/charts/substrate/templates/ate-controller.yaml
+++ b/charts/substrate/templates/ate-controller.yaml
@@ -70,8 +70,14 @@ spec:
       containers:
       - name: ate-controller
         image: {{ include "substrate.componentImage" (list "atecontroller" .) }}
-{{- if eq .Values.auth.mode "jwt" }}
         args:
+        # The atecontroller binary defaults --ateapi-conn-spec to
+        # dns:///api.ate-system.svc:443, which is correct only for the
+        # canonical render (release name "substrate" in namespace
+        # "ate-system"). Pass the chart-resolved Service so the controller
+        # dials the right backend when substrate is installed as a subchart.
+        - "--ateapi-conn-spec=dns:///{{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc:443"
+{{- if eq .Values.auth.mode "jwt" }}
         - "--ateapi-auth=jwt"
         - "--ateapi-ca-file=/run/ateapi-ca/ca.crt"
         - "--ateapi-server-name={{ include "substrate.fullname" (list "api" .) }}.{{ .Release.Namespace }}.svc"
diff --git a/charts/substrate/templates/atenet-dns.yaml b/charts/substrate/templates/atenet-dns.yaml
index 0838d2c0b..ace864570 100644
--- a/charts/substrate/templates/atenet-dns.yaml
+++ b/charts/substrate/templates/atenet-dns.yaml
@@ -150,6 +150,16 @@ spec:
         - "--log-level=debug"
         - "--interval=10s"
         - "--corefile-path=/etc/coredns/Corefile"
+        # Pass the chart-resolved Service names so the controller looks up the
+        # correct objects when substrate is installed as a subchart. The
+        # system namespace is read from POD_NAMESPACE below.
+        - "--router-service-name={{ include "substrate.fullname" (list "atenet-router" .) }}"
+        - "--dns-service-name={{ include "substrate.fullname" (list "dns" .) }}"
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
         volumeMounts:
         - name: dns-config-volume
           mountPath: /etc/coredns
diff --git a/charts/substrate/templates/atenet-router.yaml b/charts/substrate/templates/atenet-router.yaml
index 01536184a..a70291fb1 100644
--- a/charts/substrate/templates/atenet-router.yaml
+++ b/charts/substrate/templates/atenet-router.yaml
@@ -144,6 +144,9 @@ spec:
         - "--standalone"
         - "--networking-mode=agentgateway"
         - "--namespace={{ .Release.Namespace }}"
+        # Pass the chart-resolved router Service name so /statusz looks up the
+        # correct Service when substrate is installed as a subchart.
+        - "--router-service-name={{ include "substrate.fullname" (list "atenet-router" .) }}"
         - "--port-http=8080"
         - "--port-extproc=50051"
         - "--extproc-address=127.0.0.1"
diff --git a/cmd/ateapi/internal/controlapi/functional_test.go b/cmd/ateapi/internal/controlapi/functional_test.go
index b5f19881d..281c7a146 100644
--- a/cmd/ateapi/internal/controlapi/functional_test.go
+++ b/cmd/ateapi/internal/controlapi/functional_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
 	"github.com/agent-substrate/substrate/internal/envtestbins"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 	"github.com/agent-substrate/substrate/pkg/client/clientset/versioned"
@@ -273,7 +274,7 @@ func setupTest(t *testing.T, ns string) *testContext {
 
 	// 3. Initialize Informers
 	workerFactory, workerInformer := WorkerPodInformer(k8sClient)
-	ateletFactory, ateletInformer := AteletInformer(k8sClient)
+	ateletFactory, ateletInformer := AteletInformer(k8sClient, installdefaults.SystemNamespace)
 
 	substrateInformerFactory := externalversions.NewSharedInformerFactory(substrateClient, 0)
 	actorTemplateLister := substrateInformerFactory.Api().V1alpha1().ActorTemplates().Lister()
diff --git a/cmd/ateapi/internal/controlapi/informer.go b/cmd/ateapi/internal/controlapi/informer.go
index 1f082cdd0..fcaa6c3ec 100644
--- a/cmd/ateapi/internal/controlapi/informer.go
+++ b/cmd/ateapi/internal/controlapi/informer.go
@@ -25,15 +25,15 @@ import (
 )
 
 const (
-	ateletNamespace    = "ate-system"
 	byNamespaceAndName = "by-namespace-and-name"
 	byWorkerPool       = "by-worker-pool"
 	byNode             = "by-node"
 	workerPodLabel     = "ate.dev/worker-pool"
 )
 
-// AteletInformer creates a SharedInformerFactory and SharedIndexInformer for Atelet pods.
-func AteletInformer(kc kubernetes.Interface) (informers.SharedInformerFactory, cache.SharedIndexInformer) {
+// AteletInformer creates a SharedInformerFactory and SharedIndexInformer for
+// Atelet pods in the given namespace.
+func AteletInformer(kc kubernetes.Interface, ateletNamespace string) (informers.SharedInformerFactory, cache.SharedIndexInformer) {
 	factory := informers.NewSharedInformerFactoryWithOptions(kc, 0,
 		informers.WithNamespace(ateletNamespace),
 		informers.WithTweakListOptions(func(options *metav1.ListOptions) {
diff --git a/cmd/ateapi/main.go b/cmd/ateapi/main.go
index 3c79d91ff..e10cebb0c 100644
--- a/cmd/ateapi/main.go
+++ b/cmd/ateapi/main.go
@@ -34,6 +34,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache"
 	"github.com/agent-substrate/substrate/internal/ateapiauth"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/k8sjwt"
 	"github.com/agent-substrate/substrate/internal/serverboot"
 	"github.com/agent-substrate/substrate/internal/version"
@@ -135,8 +136,13 @@ func main() {
 	workerPoolLister := ateFactory.Api().V1alpha1().WorkerPools().Lister()
 	sandboxConfigLister := ateFactory.Api().V1alpha1().SandboxConfigs().Lister()
 
+	// atelet shares ateapi's namespace in every supported deployment topology,
+	// so we read it from Kubernetes' downward API rather than expose a flag.
+	ateletNamespace := installdefaults.NamespaceFromPodEnv()
+	slog.InfoContext(ctx, "Resolved atelet namespace", slog.String("atelet-namespace", ateletNamespace))
+
 	workerPodInformerFactory, workerPodInformer := controlapi.WorkerPodInformer(clientset)
-	ateletPodInformerFactory, ateletPodInformer := controlapi.AteletInformer(clientset)
+	ateletPodInformerFactory, ateletPodInformer := controlapi.AteletInformer(clientset, ateletNamespace)
 
 	syncer := controlapi.NewWorkerPoolSyncer(redisPersistence, workerPodInformer)
 	syncer.Start(ctx)
diff --git a/cmd/atenet/internal/dns.go b/cmd/atenet/internal/dns.go
index 471e93679..5fdced39d 100644
--- a/cmd/atenet/internal/dns.go
+++ b/cmd/atenet/internal/dns.go
@@ -30,6 +30,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 
 	"github.com/agent-substrate/substrate/cmd/atenet/internal/dns"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 type DnsConfig struct {
@@ -37,6 +38,8 @@ type DnsConfig struct {
 	Kubeconfig        string
 	ReconcileInterval time.Duration
 	CorefilePath      string
+	RouterServiceName string
+	DNSServiceName    string
 }
 
 func NewDnsCmd() *cobra.Command {
@@ -86,11 +89,20 @@ func NewDnsCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize cluster client: %w", err)
 			}
 
+			// atenet shares its namespace with atenet-router and substrate's
+			// CoreDNS in every supported deployment topology, so we read it
+			// from Kubernetes' downward API rather than expose a flag.
+			systemNamespace := installdefaults.NamespaceFromPodEnv()
+			slog.InfoContext(ctx, "Resolved system namespace", slog.String("system-namespace", systemNamespace))
+
 			dnsController := &dns.Controller{
-				Client:       k8sClient,
-				Interval:     cfg.ReconcileInterval,
-				CorefilePath: cfg.CorefilePath,
-				Reloader:     dns.NewConfigReloader(),
+				Client:            k8sClient,
+				Interval:          cfg.ReconcileInterval,
+				CorefilePath:      cfg.CorefilePath,
+				Reloader:          dns.NewConfigReloader(),
+				SystemNamespace:   systemNamespace,
+				RouterServiceName: cfg.RouterServiceName,
+				DNSServiceName:    cfg.DNSServiceName,
 			}
 
 			slog.InfoContext(ctx, "Starting DNS Controller subsystem")
@@ -102,6 +114,8 @@ func NewDnsCmd() *cobra.Command {
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().DurationVar(&cfg.ReconcileInterval, "interval", 10*time.Second, "Interval for reconciling DNS configurations")
 	cmd.Flags().StringVar(&cfg.CorefilePath, "corefile-path", "/etc/coredns/Corefile", "Path to the local Corefile configuration on shared volume")
+	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", installdefaults.RouterServiceName, "Service name of the atenet-router. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.DNSServiceName, "dns-service-name", installdefaults.DNSServiceName, "Service name of substrate's CoreDNS. Override when the deployment renames the Service.")
 
 	return cmd
 }
diff --git a/cmd/atenet/internal/dns/dns.go b/cmd/atenet/internal/dns/dns.go
index cf2db99b6..4cfaf34ef 100644
--- a/cmd/atenet/internal/dns/dns.go
+++ b/cmd/atenet/internal/dns/dns.go
@@ -33,18 +33,23 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-const (
-	// serviceName is the name of the CoreDNS service.
-	serviceName     = "dns"
-	systemNamespace = "ate-system"
-)
-
 // Controller manages the DNS configuration for the ATE.
 type Controller struct {
 	Client       client.Client
 	Interval     time.Duration
 	CorefilePath string
 	Reloader     ConfigReloader
+
+	// SystemNamespace is the namespace where atenet-router and the substrate
+	// CoreDNS Service live. Defaults to installdefaults.SystemNamespace.
+	SystemNamespace string
+	// RouterServiceName is the Service name of the atenet-router that the
+	// CoreDNS Corefile forwards actor traffic to. Defaults to
+	// installdefaults.RouterServiceName.
+	RouterServiceName string
+	// DNSServiceName is the Service name of substrate's CoreDNS. Defaults to
+	// installdefaults.DNSServiceName.
+	DNSServiceName string
 }
 
 // Run the DNS orchestration loop until ctx is canceled.
@@ -71,14 +76,15 @@ func (c *Controller) Run(ctx context.Context) error {
 func (c *Controller) reconcile(ctx context.Context) error {
 	slog.DebugContext(ctx, "Reconciling DNS orchestration configuration...")
 
-	// 1. Get the ClusterIP of atenet-router in ate-system namespace
+	// 1. Get the ClusterIP of the atenet-router Service in the substrate namespace.
 	routerSvc := &corev1.Service{}
-	if err := c.Client.Get(ctx, types.NamespacedName{Name: "atenet-router", Namespace: systemNamespace}, routerSvc); err != nil {
+	if err := c.Client.Get(ctx, types.NamespacedName{Name: c.RouterServiceName, Namespace: c.SystemNamespace}, routerSvc); err != nil {
 		if errors.IsNotFound(err) {
-			slog.WarnContext(ctx, "atenet-router service not found, skipping until it is available")
+			slog.WarnContext(ctx, "atenet-router service not found, skipping until it is available",
+				slog.String("name", c.RouterServiceName), slog.String("namespace", c.SystemNamespace))
 			return nil
 		}
-		return fmt.Errorf("failed to get atenet-router service: %w", err)
+		return fmt.Errorf("failed to get atenet-router service %s/%s: %w", c.SystemNamespace, c.RouterServiceName, err)
 	}
 
 	routerIP := routerSvc.Spec.ClusterIP
@@ -87,14 +93,15 @@ func (c *Controller) reconcile(ctx context.Context) error {
 		return nil
 	}
 
-	// 2. Get the ClusterIP of dns service in ate-system namespace
+	// 2. Get the ClusterIP of substrate's CoreDNS Service in the same namespace.
 	dnsSvc := &corev1.Service{}
-	if err := c.Client.Get(ctx, types.NamespacedName{Name: serviceName, Namespace: systemNamespace}, dnsSvc); err != nil {
+	if err := c.Client.Get(ctx, types.NamespacedName{Name: c.DNSServiceName, Namespace: c.SystemNamespace}, dnsSvc); err != nil {
 		if errors.IsNotFound(err) {
-			slog.WarnContext(ctx, "dns service not found, skipping until it is available")
+			slog.WarnContext(ctx, "dns service not found, skipping until it is available",
+				slog.String("name", c.DNSServiceName), slog.String("namespace", c.SystemNamespace))
 			return nil
 		}
-		return fmt.Errorf("failed to get dns service: %w", err)
+		return fmt.Errorf("failed to get dns service %s/%s: %w", c.SystemNamespace, c.DNSServiceName, err)
 	}
 
 	dnsIP := dnsSvc.Spec.ClusterIP
diff --git a/cmd/atenet/internal/dns/dns_test.go b/cmd/atenet/internal/dns/dns_test.go
index 34116db28..bf27941e1 100644
--- a/cmd/atenet/internal/dns/dns_test.go
+++ b/cmd/atenet/internal/dns/dns_test.go
@@ -28,6 +28,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 type mockConfigReloader struct {
@@ -94,10 +96,13 @@ func TestReconcile(t *testing.T) {
 
 	reloader := &mockConfigReloader{}
 	controller := &Controller{
-		Client:       client,
-		Interval:     1 * time.Second,
-		CorefilePath: corefilePath,
-		Reloader:     reloader,
+		Client:            client,
+		Interval:          1 * time.Second,
+		CorefilePath:      corefilePath,
+		Reloader:          reloader,
+		SystemNamespace:   installdefaults.SystemNamespace,
+		RouterServiceName: installdefaults.RouterServiceName,
+		DNSServiceName:    installdefaults.DNSServiceName,
 	}
 
 	// Run one reconciliation loop
@@ -185,10 +190,13 @@ func TestReconcileKubeDNSNotFound(t *testing.T) {
 		Build()
 
 	controller := &Controller{
-		Client:       client,
-		Interval:     1 * time.Second,
-		CorefilePath: corefilePath,
-		Reloader:     &mockConfigReloader{},
+		Client:            client,
+		Interval:          1 * time.Second,
+		CorefilePath:      corefilePath,
+		Reloader:          &mockConfigReloader{},
+		SystemNamespace:   installdefaults.SystemNamespace,
+		RouterServiceName: installdefaults.RouterServiceName,
+		DNSServiceName:    installdefaults.DNSServiceName,
 	}
 
 	ctx := context.Background()
diff --git a/cmd/atenet/internal/router.go b/cmd/atenet/internal/router.go
index 5ca4e254c..471351dc3 100644
--- a/cmd/atenet/internal/router.go
+++ b/cmd/atenet/internal/router.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/agent-substrate/substrate/cmd/atenet/internal/router"
 	"github.com/agent-substrate/substrate/internal/ateapiauth"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 func NewRouterCmd() *cobra.Command {
@@ -45,6 +46,7 @@ func NewRouterCmd() *cobra.Command {
 	cmd.Flags().StringVar(&cfg.MetricsAddr, "metrics-listen-addr", ":9090", "Address and port the prometheus metrics server should listen on.")
 	cmd.Flags().BoolVar(&cfg.Standalone, "standalone", false, "Run in standalone mode, bypassing creation of managed deployment and services in Kubernetes cluster")
 	cmd.Flags().StringVar(&cfg.Namespace, "namespace", "default", "Target operations namespace")
+	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", installdefaults.RouterServiceName, "Service name of this atenet-router in the operations namespace. Override when the deployment renames the Service.")
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().StringVar(&cfg.AteapiAddr, "ateapi-address", "api.ate-system.svc:443", "gRPC host address of the cluster ateapi Control instance")
 	cmd.Flags().IntVar(&cfg.HttpPort, "port-http", 8080, "TCP port for workload traffic entering through the Envoy Router")
diff --git a/cmd/atenet/internal/router/router.go b/cmd/atenet/internal/router/router.go
index 007f65c59..b2932d8b6 100644
--- a/cmd/atenet/internal/router/router.go
+++ b/cmd/atenet/internal/router/router.go
@@ -64,8 +64,12 @@ func init() {
 
 // RouterConfig holds deployment setup and endpoint options for the router node instance.
 type RouterConfig struct {
-	Standalone        bool
-	Namespace         string
+	Standalone bool
+	Namespace  string
+	// RouterServiceName is the Service name of this atenet-router in the
+	// operations namespace, used by /statusz to look up its own ClusterIP.
+	// Defaults to installdefaults.RouterServiceName.
+	RouterServiceName string
 	Kubeconfig        string
 	AteapiAddr        string
 	HttpPort          int
diff --git a/cmd/atenet/internal/router/status.go b/cmd/atenet/internal/router/status.go
index 1e3c35304..979c74cb6 100644
--- a/cmd/atenet/internal/router/status.go
+++ b/cmd/atenet/internal/router/status.go
@@ -166,7 +166,7 @@ func (s *RouterServer) getRouterIP(ctx context.Context) string {
 		return "Standalone Mode (No Cluster IP)"
 	}
 
-	svc, err := s.clientset.CoreV1().Services(s.cfg.Namespace).Get(ctx, "atenet-router", metav1.GetOptions{})
+	svc, err := s.clientset.CoreV1().Services(s.cfg.Namespace).Get(ctx, s.cfg.RouterServiceName, metav1.GetOptions{})
 	if err != nil {
 		return fmt.Sprintf("Lookup Failed: %v", err)
 	}
diff --git a/internal/ateclient/builder.go b/internal/ateclient/builder.go
index 4a47ba29d..5d01822b5 100644
--- a/internal/ateclient/builder.go
+++ b/internal/ateclient/builder.go
@@ -24,6 +24,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"go.opentelemetry.io/otel"
@@ -132,22 +133,22 @@ func dialPortForward(ctx context.Context, kubeconfigPath, k8sContext string, tra
 		return nil, fmt.Errorf("failed to create k8s client: %w", err)
 	}
 
-	// Look up the 'api' Service to dynamically get its pod selector
-	svc, err := clientset.CoreV1().Services("ate-system").Get(ctx, "api", metav1.GetOptions{})
+	// Look up the ateapi Service to dynamically get its pod selector.
+	svc, err := clientset.CoreV1().Services(installdefaults.SystemNamespace).Get(ctx, installdefaults.APIServiceName, metav1.GetOptions{})
 	if err != nil {
-		return nil, fmt.Errorf("failed to get api service: %w", err)
+		return nil, fmt.Errorf("failed to get ateapi service %s/%s: %w", installdefaults.SystemNamespace, installdefaults.APIServiceName, err)
 	}
 	selector := labels.SelectorFromSet(svc.Spec.Selector).String()
 
 	// Find the pods backing the service
-	pods, err := clientset.CoreV1().Pods("ate-system").List(ctx, metav1.ListOptions{
+	pods, err := clientset.CoreV1().Pods(installdefaults.SystemNamespace).List(ctx, metav1.ListOptions{
 		LabelSelector: selector,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to list ateapi pods: %w", err)
 	}
 	if len(pods.Items) == 0 {
-		return nil, fmt.Errorf("no ate-api-server pods found in ate-system namespace")
+		return nil, fmt.Errorf("no ate-api-server pods found in %q namespace", installdefaults.SystemNamespace)
 	}
 	targetPod := pods.Items[0]
 
@@ -254,7 +255,7 @@ func jwtDialOptions(ctx context.Context, clientset *kubernetes.Clientset) ([]grp
 			ExpirationSeconds: &expirationSeconds,
 		},
 	}
-	token, err := clientset.CoreV1().ServiceAccounts("ate-system").CreateToken(ctx, "ate-client", tokenRequest, metav1.CreateOptions{})
+	token, err := clientset.CoreV1().ServiceAccounts(installdefaults.SystemNamespace).CreateToken(ctx, "ate-client", tokenRequest, metav1.CreateOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("failed to request ateapi bearer token: %w", err)
 	}
@@ -267,7 +268,7 @@ func jwtDialOptions(ctx context.Context, clientset *kubernetes.Clientset) ([]grp
 func isJWTMode(ctx context.Context, clientset *kubernetes.Clientset) (bool, error) {
 	// TODO: Replace deployment introspection with an explicit client-readable
 	// config file once ateapi auth mode is part of install/runtime config.
-	deployment, err := clientset.AppsV1().Deployments("ate-system").Get(ctx, "ate-api-server-deployment", metav1.GetOptions{})
+	deployment, err := clientset.AppsV1().Deployments(installdefaults.SystemNamespace).Get(ctx, "ate-api-server-deployment", metav1.GetOptions{})
 	if err != nil {
 		return false, fmt.Errorf("failed to get ate-api-server deployment: %w", err)
 	}
diff --git a/internal/installdefaults/installdefaults.go b/internal/installdefaults/installdefaults.go
new file mode 100644
index 000000000..8f47d84f0
--- /dev/null
+++ b/internal/installdefaults/installdefaults.go
@@ -0,0 +1,47 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package installdefaults holds the default namespace and Service names
+// that match the canonical install layout in manifests/ate-install/.
+// Binaries use these as flag defaults; deployments that diverge from
+// the canonical layout pass actual values via the corresponding flags.
+package installdefaults
+
+import "os"
+
+const (
+	// SystemNamespace is the namespace where substrate's control-plane
+	// components and the atelet DaemonSet run.
+	SystemNamespace = "ate-system"
+	// APIServiceName is the Service name of ate-api-server.
+	APIServiceName = "api"
+	// RouterServiceName is the Service name of atenet-router.
+	RouterServiceName = "atenet-router"
+	// DNSServiceName is the Service name of substrate's CoreDNS.
+	DNSServiceName = "dns"
+
+	// PodNamespaceEnv is the conventional env var name for the namespace
+	// a pod is running in, exposed via Kubernetes' downward API.
+	PodNamespaceEnv = "POD_NAMESPACE"
+)
+
+// NamespaceFromPodEnv returns the namespace from the PodNamespaceEnv env
+// var when set (typically populated via Kubernetes' downward API), and
+// falls back to SystemNamespace for non-k8s invocations (tests, local dev).
+func NamespaceFromPodEnv() string {
+	if ns := os.Getenv(PodNamespaceEnv); ns != "" {
+		return ns
+	}
+	return SystemNamespace
+}
diff --git a/manifests/ate-install/ate-client.yaml b/manifests/ate-install/ate-client.yaml
index cc6ef76c0..e59bd53f8 100644
--- a/manifests/ate-install/ate-client.yaml
+++ b/manifests/ate-install/ate-client.yaml
@@ -1,16 +1,19 @@
-# Copyright 2026 Google LLC
+#  Copyright 2026 Google LLC
 #
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#      http://www.apache.org/licenses/LICENSE-2.0
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# DO NOT EDIT — generated from charts/substrate by hack/render-manifests.sh.
+# Run `make helm-template` to regenerate.
 
 apiVersion: v1
 kind: ServiceAccount
diff --git a/manifests/ate-install/ate-controller.yaml b/manifests/ate-install/ate-controller.yaml
index 2cfbeecb4..82eafb9cb 100644
--- a/manifests/ate-install/ate-controller.yaml
+++ b/manifests/ate-install/ate-controller.yaml
@@ -71,6 +71,13 @@ spec:
       containers:
       - name: ate-controller
         image: ko://github.com/agent-substrate/substrate/cmd/atecontroller
+        args:
+        # The atecontroller binary defaults --ateapi-conn-spec to
+        # dns:///api.ate-system.svc:443, which is correct only for the
+        # canonical render (release name "substrate" in namespace
+        # "ate-system"). Pass the chart-resolved Service so the controller
+        # dials the right backend when substrate is installed as a subchart.
+        - "--ateapi-conn-spec=dns:///api.ate-system.svc:443"
         ports:
         - name: metrics
           containerPort: 8080
diff --git a/manifests/ate-install/atenet-dns.yaml b/manifests/ate-install/atenet-dns.yaml
index c925ada82..48507c880 100644
--- a/manifests/ate-install/atenet-dns.yaml
+++ b/manifests/ate-install/atenet-dns.yaml
@@ -170,6 +170,16 @@ spec:
         - "--log-level=debug"
         - "--interval=10s"
         - "--corefile-path=/etc/coredns/Corefile"
+        # Pass the chart-resolved Service names so the controller looks up the
+        # correct objects when substrate is installed as a subchart. The
+        # system namespace is read from POD_NAMESPACE below.
+        - "--router-service-name=atenet-router"
+        - "--dns-service-name=dns"
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
         volumeMounts:
         - name: dns-config-volume
           mountPath: /etc/coredns
diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
index 54eb77e05..e389432d7 100644
--- a/manifests/ate-install/atenet-router.yaml
+++ b/manifests/ate-install/atenet-router.yaml
@@ -161,6 +161,9 @@ spec:
         - "--standalone"
         - "--networking-mode=agentgateway"
         - "--namespace=ate-system"
+        # Pass the chart-resolved router Service name so /statusz looks up the
+        # correct Service when substrate is installed as a subchart.
+        - "--router-service-name=atenet-router"
         - "--port-http=8080"
         - "--port-extproc=50051"
         - "--extproc-address=127.0.0.1"