diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index ce49f6767a..447735deef 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -121,6 +121,11 @@ jobs:
           NVCA_OTEL_COLLECTOR_IMAGE_TAG="$(yq '.otelCollector.imageTag' nvca-operator/values.yaml)" \
             make check-vendor-chart
 
+      - name: Test NVCA default ownership
+        run: |
+          make -C deploy/helm/nvca-operator test-default-ownership
+          make -C deploy/stacks/nvcf-compute-plane test-nvca-default-ownership
+
       - name: Run self-managed Helmfile render tests
         run: make -C deploy/stacks/self-managed test
 
diff --git a/deploy/helm/nvca-operator/Makefile b/deploy/helm/nvca-operator/Makefile
index b43d7a99a7..08d62d3841 100644
--- a/deploy/helm/nvca-operator/Makefile
+++ b/deploy/helm/nvca-operator/Makefile
@@ -44,7 +44,7 @@ OCI_REGISTRY_NAMESPACE ?= <your-org>
 CHART_NAME := $(shell yq -r .name $(helm_dir)/Chart.yaml)
 CHART_VERSION := $(shell yq -r .version $(helm_dir)/Chart.yaml)
 
-.PHONY: install uninstall status lint template validate clean package push-oci sync-chart check-synced-chart render-values-from-stack install-from-stack test-render-values test-vendor-chart-image-tag test-build-release-assets test-release-image-manifest test-release-artifact-permissions test-package-release-assets test-attach-release-assets test-release-sbom-wrapper test-self-managed-nvca-image-reference test-otel-collector-compatibility test-image-pull-secret-defaults test-pod-disruption-budget test-first-class-byoo-values test-first-class-storage-worker-values
+.PHONY: install uninstall status lint template validate clean package push-oci sync-chart check-synced-chart render-values-from-stack install-from-stack test-render-values test-vendor-chart-image-tag test-build-release-assets test-release-image-manifest test-release-artifact-permissions test-package-release-assets test-attach-release-assets test-release-sbom-wrapper test-self-managed-nvca-image-reference test-otel-collector-compatibility test-image-pull-secret-defaults test-pod-disruption-budget test-first-class-byoo-values test-first-class-storage-worker-values test-default-ownership
 
 install:
 ifndef values
@@ -131,6 +131,9 @@ test-first-class-byoo-values:
 test-first-class-storage-worker-values:
 	@bash ./tests/first_class_storage_worker_values_test.sh
 
+test-default-ownership:
+	@bash ./tests/default_ownership_test.sh
+
 uninstall:
 	@echo "Deleting $(release) from namespace $(namespace)..."
 	helm uninstall $(release) --namespace $(namespace)
diff --git a/deploy/helm/nvca-operator/nvca-operator/README.md b/deploy/helm/nvca-operator/nvca-operator/README.md
index 65c478067d..5e72f3d3aa 100644
--- a/deploy/helm/nvca-operator/nvca-operator/README.md
+++ b/deploy/helm/nvca-operator/nvca-operator/README.md
@@ -184,6 +184,7 @@ This release does not wire the catalog into backend selection. Runtime use requi
 | `selfManaged.featureGateValues`               | (Optional) List of feature gates to enable. Defaults to ["DynamicGPUDiscovery"] if not specified.                                                                                    | `["DynamicGPUDiscovery"]`                  |
 | `selfManaged.gpuManualInstanceConfigB64`      | (Optional) Base64 encoded GPU manual instance configuration. Leave blank if not required.                                                                                            | `""`                                       |
 | `selfManaged.clusterAttributes`               | (Optional) List of attributes for the cluster. Defaults to an empty array.                                                                                                           | `[]`                                       |
+| `selfManaged.region`                          | Region reported for a self-managed cluster.                                                                                                                                          | `us-west-1`                                |
 | `selfManaged.imageCredHelper.imageRepository` | (OPTIONAL) Image repository of "nvcf-image-credential-helper". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository. | `""`                                       |
 | `selfManaged.imageCredHelper.imageTag`        | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.                                                                           | `0.11.1`                                    |
 | `selfManaged.otelCollector.enabled`           | Enable OTel collector sidecar for self-managed clusters                                                                                                                              | `false`                                    |
diff --git a/deploy/helm/nvca-operator/nvca-operator/values.schema.json b/deploy/helm/nvca-operator/nvca-operator/values.schema.json
index f0286a07dd..8b9de85d91 100644
--- a/deploy/helm/nvca-operator/nvca-operator/values.schema.json
+++ b/deploy/helm/nvca-operator/nvca-operator/values.schema.json
@@ -1021,6 +1021,11 @@
                     "default": [],
                     "items": {}
                 },
+                "region": {
+                    "type": "string",
+                    "description": "Region reported for a self-managed cluster.",
+                    "default": "us-west-1"
+                },
                 "imageCredHelper": {
                     "type": "object",
                     "properties": {
diff --git a/deploy/helm/nvca-operator/nvca-operator/values.yaml b/deploy/helm/nvca-operator/nvca-operator/values.yaml
index 2490210823..3feaa211b8 100644
--- a/deploy/helm/nvca-operator/nvca-operator/values.yaml
+++ b/deploy/helm/nvca-operator/nvca-operator/values.yaml
@@ -410,6 +410,8 @@ selfManaged:
   gpuManualInstanceConfigB64: ""
   ## @param selfManaged.clusterAttributes (Optional) List of attributes for the cluster. Defaults to an empty array.
   clusterAttributes: []
+  ## @param selfManaged.region Region reported for a self-managed cluster.
+  region: us-west-1
   ## @param selfManaged.imageCredHelper.imageRepository (OPTIONAL) Image repository of "nvcf-image-credential-helper". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository.
   ## @param selfManaged.imageCredHelper.imageTag (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.
   imageCredHelper:
diff --git a/deploy/helm/nvca-operator/tests/default_ownership_test.sh b/deploy/helm/nvca-operator/tests/default_ownership_test.sh
new file mode 100755
index 0000000000..a9b8825331
--- /dev/null
+++ b/deploy/helm/nvca-operator/tests/default_ownership_test.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+chart_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+chart="${chart_root}/nvca-operator"
+work_dir="$(mktemp -d)"
+trap 'rm -rf "${work_dir}"' EXIT
+
+fail() {
+  echo "default-ownership: $*" >&2
+  exit 1
+}
+
+for schema in \
+  "${chart}/values.schema.json" \
+  "${chart_root}/../../../src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json"; do
+  test "$(yq -r '.properties.selfManaged.properties.region.default' "${schema}")" = "us-west-1" ||
+    fail "${schema} does not declare the selfManaged.region default"
+  test "$(yq -r '.properties.helmManaged.properties | has("region")' "${schema}")" = "false" ||
+    fail "${schema} incorrectly declares region under helmManaged"
+done
+
+render() {
+  local manifest="$1"
+  shift
+  helm template nvca-operator "${chart}" \
+    --namespace nvca-operator \
+    --values "${chart}/values.yaml" \
+    --set-string ngcConfig.clusterSource=self-managed \
+    --set-string selfManaged.icmsServiceURL=http://icms.example.invalid:8080 \
+    --set-string selfManaged.revalServiceURL=http://reval.example.invalid:8080 \
+    --set-string selfManaged.natsURL=nats://nats.example.invalid:4222 \
+    "$@" >"${manifest}"
+}
+
+agent_config() {
+  yq ea -r \
+    'select(.kind == "ConfigMap" and .metadata.name == "agent-config-merge") | .data."config.yaml"' \
+    "$1"
+}
+
+backend_config() {
+  yq ea -r \
+    'select(.kind == "ConfigMap" and .metadata.name == "nvcfbackend-self-managed") | .data."cluster-dto.yaml"' \
+    "$1"
+}
+
+default_manifest="${work_dir}/default.yaml"
+render "${default_manifest}"
+default_config="$(agent_config "${default_manifest}")"
+default_policy="$(printf '%s' "${default_config}" | yq -r '.cluster.validationPolicy.name')"
+test "${default_policy}" = "Unrestricted" ||
+  fail "chart default validation policy is ${default_policy:-missing}, expected Unrestricted"
+default_quic_present="$(printf '%s' "${default_config}" | yq -r '(.workload // {}) | has("stargateQUICInsecure")')"
+test "${default_quic_present}" = "false" ||
+  fail "chart serializes the runtime-default stargateQUICInsecure value"
+default_region="$(backend_config "${default_manifest}" | yq -r '.region')"
+test "${default_region}" = "us-west-1" ||
+  fail "chart default self-managed region is ${default_region:-missing}, expected us-west-1"
+
+override_values="${work_dir}/override.yaml"
+printf '%s\n' \
+  'agentConfig:' \
+  '  mergeConfig: |' \
+  '    cluster:' \
+  '      validationPolicy:' \
+  '        name: Default' \
+  '    workload:' \
+  '      stargateQUICInsecure: true' \
+  'selfManaged:' \
+  '  region: explicit-region' >"${override_values}"
+
+override_manifest="${work_dir}/override.yaml.rendered"
+render "${override_manifest}" --values "${override_values}"
+override_config="$(agent_config "${override_manifest}")"
+override_policy="$(printf '%s' "${override_config}" | yq -r '.cluster.validationPolicy.name')"
+test "${override_policy}" = "Default" ||
+  fail "explicit validation policy override was not preserved"
+override_quic="$(printf '%s' "${override_config}" | yq -r '.workload.stargateQUICInsecure')"
+test "${override_quic}" = "true" ||
+  fail "explicit stargateQUICInsecure override was not preserved"
+override_region="$(backend_config "${override_manifest}" | yq -r '.region')"
+test "${override_region}" = "explicit-region" ||
+  fail "explicit selfManaged.region override was not preserved"
+
+echo "default-ownership: all checks passed"
diff --git a/deploy/stacks/nvcf-compute-plane/Makefile b/deploy/stacks/nvcf-compute-plane/Makefile
index 394bb18bf4..bc3a4de870 100644
--- a/deploy/stacks/nvcf-compute-plane/Makefile
+++ b/deploy/stacks/nvcf-compute-plane/Makefile
@@ -60,7 +60,7 @@ include Makefile.dist
 -include helmfile-docker.mk
 
 # --- Development-Only Targets ---
-.PHONY: dist clean-dist ensure-helm ensure-helmfile ensure-binaries render-local test-observability-profile test-register-cluster test-kube-context test-compare-golden test-nats-reloader-alignment test-nvca-entrypoints test-local generate-golden
+.PHONY: dist clean-dist ensure-helm ensure-helmfile ensure-binaries render-local test-observability-profile test-register-cluster test-kube-context test-compare-golden test-nats-reloader-alignment test-nvca-entrypoints test-nvca-default-ownership test-local generate-golden
 
 # --- Binary Management (Development Only) ---
 ensure-helm:
@@ -181,13 +181,16 @@ test-kube-context:
 test-nvca-entrypoints: render-local
 	@tests/nvca-entrypoints.sh "$(DIST_DIR)/out"
 
+test-nvca-default-ownership:
+	@tests/nvca-default-ownership.sh
+
 test-compare-golden:
 	@tests/test-compare-golden.sh
 
 test-nats-reloader-alignment:
 	@tests/nats-reloader-alignment.sh
 
-test-local: test-observability-profile test-register-cluster test-kube-context test-compare-golden test-nats-reloader-alignment test-nvca-entrypoints
+test-local: test-observability-profile test-register-cluster test-kube-context test-nvca-default-ownership test-compare-golden test-nats-reloader-alignment test-nvca-entrypoints
 	@tests/verify-golden.sh "$(GOLDEN_LOCAL_DIR)" "$(DIST_DIR)/out"
 
 generate-golden: render-local
diff --git a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl
index d1ca849791..f8fd94e449 100644
--- a/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl
+++ b/deploy/stacks/nvcf-compute-plane/helmfile.d/02-nvca.yaml.gotmpl
@@ -167,9 +167,10 @@ helmDefaults:
 {{-     end }}
 {{-   end }}
 {{-   $validationPolicy = set $validationPolicy "allowedExtraKubernetesTypes" $allowedTypes }}
-{{- /* ReVal only accepts "Default" or "Unrestricted"; an unset name is rejected. */}}
+{{- /* Preserve the self-managed chart default when the stack extends the
+       string-valued mergeConfig with extra Kubernetes types. */}}
 {{-   if not (dig "name" "" $validationPolicy) }}
-{{-     $validationPolicy = set $validationPolicy "name" "Default" }}
+{{-     $validationPolicy = set $validationPolicy "name" "Unrestricted" }}
 {{-   end }}
 {{-   $cluster := set (dig "cluster" dict $agentMergeConfig) "validationPolicy" $validationPolicy }}
 {{-   $agentMergeConfig = set $agentMergeConfig "cluster" $cluster }}
@@ -223,9 +224,8 @@ releases:
         ngcConfig:
           clusterSource: self-managed
         clusterName: {{ requiredEnv "CLUSTER_NAME" }}
-        ncaId: {{ requiredEnv "NCA_ID" }}
+        ncaID: {{ requiredEnv "NCA_ID" }}
         selfManaged:
-          identitySource: psat
           {{- with dig "nvcaVersion" "" $selfManaged }}
           nvcaVersion: {{ . | quote }}
           {{- end }}
diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml
index c7bb20ed24..285afa59a2 100644
--- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml
+++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml
@@ -105,7 +105,7 @@ spec:
         args:
           - /usr/bin/nvca-operator
           - --nca-id
-          - "nvcf-default"
+          - "ncp-local"
           - --system-namespace
           - "nvca-operator"
           - --cluster-name
diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml
index 1a1bec33ed..7b83908252 100644
--- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml
+++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml
@@ -36,11 +36,11 @@ data:
     clusterName: "ncp-local"
     clusterDescription: "ncp-local"
     clusterGroupName: "nvcf-default"
-    ncaID: "nvcf-default"
+    ncaID: "ncp-local"
     nvcaVersion: "3.8.0"
     oAuthClientId: ""
     cloudProvider: "NCP"
-    region: "us-west-1"
+    region: "us-east-1"
     attributes: []
     capabilities: ["DynamicGPUDiscovery","InfraResourceOverhead","EnforceHelmFunctionResourceLimits","EnforceContainerFunctionResourceLimits","EnforceHelmTaskResourceLimits","EnforceContainerTaskResourceLimits","BYOObservability","KAIScheduler","DynamoOperatorSupport"]
     gpusB64: ""
diff --git a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/ncp-local-register-values.yaml b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/ncp-local-register-values.yaml
index 17604177cd..bac8228d8e 100644
--- a/deploy/stacks/nvcf-compute-plane/testdata/golden/local/ncp-local-register-values.yaml
+++ b/deploy/stacks/nvcf-compute-plane/testdata/golden/local/ncp-local-register-values.yaml
@@ -1,10 +1,8 @@
 clusterName: my-local-cluster
 clusterID: de5f65fe-08d7-47e7-bf30-860e2fe88c57
 clusterGroupID: e1c9fcdd-5551-4824-816f-87a044a5dd33
-ncaID: nvcf-default
-region: us-east-1
 selfManaged:
-  identitySource: psat
+  region: us-east-1
   icmsServiceURL: http://icms.example.invalid:8080
   revalServiceURL: http://reval.example.invalid:8080
   natsURL: nats://nats.example.invalid:4222
diff --git a/deploy/stacks/nvcf-compute-plane/testdata/registration/ncp-local-register-values.yaml b/deploy/stacks/nvcf-compute-plane/testdata/registration/ncp-local-register-values.yaml
index 17604177cd..bac8228d8e 100644
--- a/deploy/stacks/nvcf-compute-plane/testdata/registration/ncp-local-register-values.yaml
+++ b/deploy/stacks/nvcf-compute-plane/testdata/registration/ncp-local-register-values.yaml
@@ -1,10 +1,8 @@
 clusterName: my-local-cluster
 clusterID: de5f65fe-08d7-47e7-bf30-860e2fe88c57
 clusterGroupID: e1c9fcdd-5551-4824-816f-87a044a5dd33
-ncaID: nvcf-default
-region: us-east-1
 selfManaged:
-  identitySource: psat
+  region: us-east-1
   icmsServiceURL: http://icms.example.invalid:8080
   revalServiceURL: http://reval.example.invalid:8080
   natsURL: nats://nats.example.invalid:4222
diff --git a/deploy/stacks/nvcf-compute-plane/tests/nvca-default-ownership.sh b/deploy/stacks/nvcf-compute-plane/tests/nvca-default-ownership.sh
new file mode 100755
index 0000000000..f8efc9b08b
--- /dev/null
+++ b/deploy/stacks/nvcf-compute-plane/tests/nvca-default-ownership.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+stack_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+work_dir="$(mktemp -d)"
+cluster_name="default-ownership"
+registration_values="${work_dir}/${cluster_name}-register-values.yaml"
+trap 'rm -rf "${work_dir}"' EXIT
+
+fail() {
+  echo "nvca-default-ownership: $*" >&2
+  exit 1
+}
+
+render_values() {
+  local output_file="$1"
+  shift
+  HELMFILE_ENV=base \
+    CLUSTER_NAME="${cluster_name}" \
+    NCA_ID=authoritative-nca \
+    OUTPUT_DIR="${work_dir}" \
+    helmfile \
+      --file "${stack_dir}/helmfile.d/02-nvca.yaml.gotmpl" \
+      --environment default \
+      "$@" \
+      --selector name=nvca-operator \
+      write-values \
+      --output-file-template "${output_file}" >/dev/null
+}
+
+write_registration() {
+  local merge_config="${1:-}"
+  printf '%s\n' \
+    'clusterName: default-ownership' \
+    'clusterID: fixture-cluster-id' \
+    'clusterGroupID: fixture-cluster-group-id' \
+    'selfManaged:' \
+    '  region: fixture-region' \
+    '  icmsServiceURL: http://icms.example.invalid:8080' \
+    '  revalServiceURL: http://reval.example.invalid:8080' \
+    '  natsURL: nats://nats.example.invalid:4222' >"${registration_values}"
+  if [[ -n "${merge_config}" ]]; then
+    printf 'agentConfig:\n  mergeConfig: |\n%s\n' "${merge_config}" >>"${registration_values}"
+  fi
+}
+
+write_registration
+default_values="${work_dir}/default-values.yaml"
+render_values "${default_values}"
+test "$(yq -r '.ncaID' "${default_values}")" = "authoritative-nca" ||
+  fail "NCA_ID was not forwarded with the chart-consumed ncaID spelling"
+test "$(yq -r '.ncaId // "omitted"' "${default_values}")" = "omitted" ||
+  fail "stack emitted the unused ncaId spelling"
+test "$(yq -r '.selfManaged.region' "${default_values}")" = "fixture-region" ||
+  fail "selfManaged.region was not preserved"
+test "$(yq -r '.selfManaged.identitySource // "omitted"' "${default_values}")" = "omitted" ||
+  fail "render-only registration values contain CLI lifecycle metadata"
+test "$(yq -r '.agentConfig // "omitted"' "${default_values}")" = "omitted" ||
+  fail "stack shadowed the chart agentConfig defaults without an explicit merge"
+test "$(yq -r '.nodeSelector // "omitted"' "${default_values}")" = "omitted" ||
+  fail "stack emitted a node selector while the singular global default is disabled"
+
+write_registration '    workload:
+      defaultOwnershipProbe: true'
+extended_values="${work_dir}/extended-values.yaml"
+render_values "${extended_values}" --state-values-set addons.kaiScheduler.enabled=true
+extended_config="$(yq -r '.agentConfig.mergeConfig' "${extended_values}")"
+test "$(printf '%s' "${extended_config}" | yq -r '.cluster.validationPolicy.name')" = "Unrestricted" ||
+  fail "stack extension did not preserve the chart validation policy default"
+test "$(printf '%s' "${extended_config}" | yq -r '.workload.defaultOwnershipProbe')" = "true" ||
+  fail "stack extension dropped the explicit mergeConfig override"
+
+write_registration '    cluster:
+      validationPolicy:
+        name: Default'
+override_values="${work_dir}/override-values.yaml"
+render_values "${override_values}" --state-values-set addons.kaiScheduler.enabled=true
+override_config="$(yq -r '.agentConfig.mergeConfig' "${override_values}")"
+test "$(printf '%s' "${override_config}" | yq -r '.cluster.validationPolicy.name')" = "Default" ||
+  fail "stack replaced an explicit validation policy override"
+
+echo "nvca-default-ownership: all checks passed"
diff --git a/docs/user/cli.md b/docs/user/cli.md
index 36e6a71dfb..9ece976581 100644
--- a/docs/user/cli.md
+++ b/docs/user/cli.md
@@ -565,14 +565,17 @@ schema:
 clusterID: <uuid>
 clusterGroupID: <uuid>
 ncaID: <nca-id>
-region: <region>
 selfManaged:
+  region: <region>
   identitySource: psat
   icmsServiceURL: "http://<GATEWAY_ADDR>"
   revalServiceURL: "http://<GATEWAY_ADDR>"
   natsURL: "nats://<GATEWAY_ADDR>:4222"
 ```
 
+`selfManaged.identitySource` is CLI lifecycle metadata used when unregistering
+the cluster; the NVCA Operator chart does not consume it.
+
 For load-balancer-fronted gateways that route by hostname, add the matching host-header
 overrides (`selfManaged.icmsServiceHostHeaderOverride`,
 `selfManaged.revalServiceHostHeaderOverride`, `selfManaged.natsHostOverride`) to these
diff --git a/docs/user/cluster-management/self-managed.md b/docs/user/cluster-management/self-managed.md
index fbf8369556..0eb2c6705b 100644
--- a/docs/user/cluster-management/self-managed.md
+++ b/docs/user/cluster-management/self-managed.md
@@ -207,14 +207,17 @@ identity and endpoints:
 clusterID: <uuid>
 clusterGroupID: <uuid>
 ncaID: <nca-id>
-region: <region>
 selfManaged:
+  region: <region>
   identitySource: psat
   icmsServiceURL: "http://<GATEWAY_ADDR>"
   revalServiceURL: "http://<GATEWAY_ADDR>"
   natsURL: "nats://<GATEWAY_ADDR>:4222"
 ```
 
+`selfManaged.identitySource` is retained for CLI teardown and is not consumed
+by the NVCA Operator chart.
+
 The `template`, `install`, and `apply` targets copy this file into `out/` before
 running Helmfile.
 
diff --git a/src/clis/nvcf-cli/cmd/cluster_registration.go b/src/clis/nvcf-cli/cmd/cluster_registration.go
index 2365fe185b..f589a53fee 100644
--- a/src/clis/nvcf-cli/cmd/cluster_registration.go
+++ b/src/clis/nvcf-cli/cmd/cluster_registration.go
@@ -552,21 +552,21 @@ func registeredClusterIDs(resp *client.RegisterClusterResponse) (clusterGroupID,
 // Schema matches the nvca-operator chart's expected keys. clusterID,
 // clusterGroupID, and ncaID live at the top level with the mixed-case "ID"
 // suffix to match the `## @param` annotations in
-// `deployments/nvca-operator/values.yaml` (e.g. `## @param clusterID`).
-// `selfManaged.identitySource` stays nested because it scopes a self-managed-
-// only knob (PSAT vs SPIRE) and the chart's `selfManaged:` block already
-// houses other self-managed-specific fields like `nvcaVersion`.
+// `deployments/nvca-operator/values.yaml` (e.g. `## @param clusterID`). Region
+// lives under selfManaged because that is the value the self-managed backend
+// template consumes. identitySource is lifecycle metadata used by CLI teardown;
+// the chart deliberately ignores it.
 type helmValues struct {
 	ClusterName    string            `yaml:"clusterName,omitempty"`
 	ClusterID      string            `yaml:"clusterID"`
 	ClusterGroupID string            `yaml:"clusterGroupID"`
 	NcaID          string            `yaml:"ncaID"`
-	Region         string            `yaml:"region"`
 	SelfManaged    selfManagedValues `yaml:"selfManaged"`
 }
 
 type selfManagedValues struct {
 	IdentitySource                 string `yaml:"identitySource"`
+	Region                         string `yaml:"region"`
 	ICMSServiceURL                 string `yaml:"icmsServiceURL,omitempty"`
 	ICMSServiceHostHeaderOverride  string `yaml:"icmsServiceHostHeaderOverride,omitempty"`
 	ReValServiceURL                string `yaml:"revalServiceURL,omitempty"`
@@ -596,8 +596,7 @@ func printRegistrationOutput(name, clusterGroupID, clusterID, ncaID, region, iss
 		ClusterID:      clusterID,
 		ClusterGroupID: clusterGroupID,
 		NcaID:          ncaID,
-		Region:         region,
-		SelfManaged:    newSelfManagedValues(identitySource, icmsURL, natsURL),
+		SelfManaged:    newSelfManagedValues(identitySource, region, icmsURL, natsURL),
 	}
 
 	out, err := yaml.Marshal(vals)
@@ -608,17 +607,18 @@ func printRegistrationOutput(name, clusterGroupID, clusterID, ncaID, region, iss
 	fmt.Print(string(out))
 }
 
-func newSelfManagedValues(identitySource, icmsServiceURL, natsURL string) selfManagedValues {
-	return newSelfManagedValuesFromEndpoints(identitySource, registerEndpointValues{
+func newSelfManagedValues(identitySource, region, icmsServiceURL, natsURL string) selfManagedValues {
+	return newSelfManagedValuesFromEndpoints(identitySource, region, registerEndpointValues{
 		ICMSServiceURL:  icmsServiceURL,
 		ReValServiceURL: deriveSiblingHTTPServiceURL(icmsServiceURL, "reval"),
 		NATSURL:         natsURL,
 	})
 }
 
-func newSelfManagedValuesFromEndpoints(identitySource string, endpoints registerEndpointValues) selfManagedValues {
+func newSelfManagedValuesFromEndpoints(identitySource, region string, endpoints registerEndpointValues) selfManagedValues {
 	return selfManagedValues{
 		IdentitySource:                 identitySource,
+		Region:                         region,
 		ICMSServiceURL:                 endpoints.ICMSServiceURL,
 		ICMSServiceHostHeaderOverride:  endpoints.ICMSServiceHostHeaderOverride,
 		ReValServiceURL:                endpoints.ReValServiceURL,
diff --git a/src/clis/nvcf-cli/cmd/cluster_registration_test.go b/src/clis/nvcf-cli/cmd/cluster_registration_test.go
index 18a9351b1e..ecca50dd05 100644
--- a/src/clis/nvcf-cli/cmd/cluster_registration_test.go
+++ b/src/clis/nvcf-cli/cmd/cluster_registration_test.go
@@ -440,9 +440,9 @@ func TestHelmValuesYAMLSchema(t *testing.T) {
 		ClusterID:      "cl-123",
 		ClusterGroupID: "cg-456",
 		NcaID:          "nca-789",
-		Region:         "us-west-1",
 		SelfManaged: selfManagedValues{
 			IdentitySource:  "psat",
+			Region:          "us-west-1",
 			ICMSServiceURL:  "http://sis.localhost:18080",
 			ReValServiceURL: "http://reval.localhost:18080",
 			NATSURL:         "nats://nats.localhost:4222",
@@ -457,9 +457,10 @@ func TestHelmValuesYAMLSchema(t *testing.T) {
 	assert.Contains(t, got, "clusterID: cl-123")
 	assert.Contains(t, got, "clusterGroupID: cg-456")
 	assert.Contains(t, got, "ncaID: nca-789")
-	assert.Contains(t, got, "region: us-west-1")
-	// identitySource stays nested under selfManaged.
-	assert.Contains(t, got, "selfManaged:\n    identitySource: psat")
+	assert.NotContains(t, got, "\nregion: us-west-1")
+	// Region is chart configuration and identitySource is CLI lifecycle
+	// metadata; both stay nested under selfManaged.
+	assert.Contains(t, got, "selfManaged:\n    identitySource: psat\n    region: us-west-1")
 	assert.Contains(t, got, "icmsServiceURL: http://sis.localhost:18080")
 	assert.Contains(t, got, "revalServiceURL: http://reval.localhost:18080")
 	assert.Contains(t, got, "natsURL: nats://nats.localhost:4222")
diff --git a/src/clis/nvcf-cli/cmd/self_hosted_compute_plane.go b/src/clis/nvcf-cli/cmd/self_hosted_compute_plane.go
index 70a6f9f158..eb4a17d47a 100644
--- a/src/clis/nvcf-cli/cmd/self_hosted_compute_plane.go
+++ b/src/clis/nvcf-cli/cmd/self_hosted_compute_plane.go
@@ -577,9 +577,9 @@ func writeComputePlaneNVCAValues(req computePlaneNVCAValuesRequest) error {
 		ClusterID:      req.Registration.ClusterID,
 		ClusterGroupID: req.Registration.ClusterGroupID,
 		NCAID:          req.NCAID,
-		Region:         req.Region,
 		SelfManaged: nvca.SelfManagedValues{
 			IdentitySource:                 req.IdentitySource,
+			Region:                         req.Region,
 			ICMSServiceURL:                 req.Endpoints.ICMSURL,
 			ICMSServiceHostHeaderOverride:  req.Hosts.SIS,
 			ReValServiceURL:                req.Endpoints.ReValURL,
diff --git a/src/clis/nvcf-cli/cmd/self_hosted_up.go b/src/clis/nvcf-cli/cmd/self_hosted_up.go
index e8552d3b5e..d9b3f9f9e4 100644
--- a/src/clis/nvcf-cli/cmd/self_hosted_up.go
+++ b/src/clis/nvcf-cli/cmd/self_hosted_up.go
@@ -1512,9 +1512,9 @@ func kubectxFor(phaseNum int) string {
 // `printRegistrationOutput` (cmd/cluster_registration.go, fixed in `ff9aaf7`):
 // top-level `clusterID`/`clusterGroupID`/`ncaID` with the mixed-case "ID" suffix
 // to match the nvca-operator chart's `## @param` annotations in
-// `nvca-operator/values.yaml`. `selfManaged.identitySource` and endpoint
-// values stay nested because they scope self-managed-only chart inputs alongside
-// the chart's other `selfManaged:` keys (`nvcaVersion`, `region`, etc.).
+// `nvca-operator/values.yaml`. Region and endpoint values stay nested because
+// the chart consumes them from `selfManaged:`. identitySource is retained there
+// as CLI lifecycle metadata for teardown even though the chart ignores it.
 //
 // The pre-`ff9aaf7` shape (nested `selfManaged.clusterId`, lowercase-d) left
 // the chart's `.Values.clusterID` empty → cluster-dto.yaml rendered with empty
@@ -1540,8 +1540,7 @@ func writeRegisterValuesYAML(req registerValuesWriteRequest) error {
 		ClusterID:      req.ClusterID,
 		ClusterGroupID: req.ClusterGroupID,
 		NcaID:          req.NCAID,
-		Region:         req.Region,
-		SelfManaged:    newSelfManagedValuesFromEndpoints(req.IdentitySource, req.Endpoints),
+		SelfManaged:    newSelfManagedValuesFromEndpoints(req.IdentitySource, req.Region, req.Endpoints),
 	}
 	body, err := yaml.Marshal(vals)
 	if err != nil {
diff --git a/src/clis/nvcf-cli/internal/selfhosted/nvca/values.go b/src/clis/nvcf-cli/internal/selfhosted/nvca/values.go
index 5443cb34f2..4e3a41377c 100644
--- a/src/clis/nvcf-cli/internal/selfhosted/nvca/values.go
+++ b/src/clis/nvcf-cli/internal/selfhosted/nvca/values.go
@@ -30,7 +30,6 @@ type Values struct {
 	ClusterID      string             `yaml:"clusterID"`
 	ClusterGroupID string             `yaml:"clusterGroupID"`
 	NCAID          string             `yaml:"ncaID"`
-	Region         string             `yaml:"region"`
 	SelfManaged    SelfManagedValues  `yaml:"selfManaged"`
 	Agent          *AgentValues       `yaml:"agent,omitempty"`
 	AgentConfig    *AgentConfigValues `yaml:"agentConfig,omitempty"`
@@ -59,6 +58,7 @@ type AgentConfigValues struct {
 
 type SelfManagedValues struct {
 	IdentitySource                 string `yaml:"identitySource"`
+	Region                         string `yaml:"region"`
 	ICMSServiceURL                 string `yaml:"icmsServiceURL,omitempty"`
 	ICMSServiceHostHeaderOverride  string `yaml:"icmsServiceHostHeaderOverride,omitempty"`
 	ReValServiceURL                string `yaml:"revalServiceURL,omitempty"`
diff --git a/src/clis/nvcf-cli/internal/selfhosted/nvca/values_test.go b/src/clis/nvcf-cli/internal/selfhosted/nvca/values_test.go
index 61e162323b..602410046e 100644
--- a/src/clis/nvcf-cli/internal/selfhosted/nvca/values_test.go
+++ b/src/clis/nvcf-cli/internal/selfhosted/nvca/values_test.go
@@ -84,6 +84,7 @@ func TestWriteFileRoundTrip(t *testing.T) {
 		ClusterGroupID: "g-1",
 		SelfManaged: SelfManagedValues{
 			IdentitySource: "psat",
+			Region:         "eu-west-1",
 		},
 		AgentConfig: &AgentConfigValues{MergeConfig: "workload:\n  transportTLS:\n    trustMode: system\n"},
 	}))
@@ -91,6 +92,8 @@ func TestWriteFileRoundTrip(t *testing.T) {
 	require.NoError(t, err)
 	var got Values
 	require.NoError(t, yaml.Unmarshal(body, &got))
+	require.NotContains(t, string(body), "\nregion: eu-west-1")
+	require.Contains(t, string(body), "\n    region: eu-west-1")
 	require.NotNil(t, got.AgentConfig)
 	require.Contains(t, got.AgentConfig.MergeConfig, "trustMode: system")
 }
diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/README.md b/src/compute-plane-services/nvca/deployments/nvca-operator/README.md
index 3086126749..bfcff8f7f0 100644
--- a/src/compute-plane-services/nvca/deployments/nvca-operator/README.md
+++ b/src/compute-plane-services/nvca/deployments/nvca-operator/README.md
@@ -184,6 +184,7 @@ This release does not wire the catalog into backend selection. Runtime use requi
 | `selfManaged.featureGateValues`               | (Optional) List of feature gates to enable. Defaults to ["DynamicGPUDiscovery"] if not specified.                                                                                    | `["DynamicGPUDiscovery"]`                  |
 | `selfManaged.gpuManualInstanceConfigB64`      | (Optional) Base64 encoded GPU manual instance configuration. Leave blank if not required.                                                                                            | `""`                                       |
 | `selfManaged.clusterAttributes`               | (Optional) List of attributes for the cluster. Defaults to an empty array.                                                                                                           | `[]`                                       |
+| `selfManaged.region`                          | Region reported for a self-managed cluster.                                                                                                                                          | `us-west-1`                                |
 | `selfManaged.imageCredHelper.imageRepository` | (OPTIONAL) Image repository of "nvcf-image-credential-helper". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository. | `""`                                       |
 | `selfManaged.imageCredHelper.imageTag`        | (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.                                                                           | `0.11.1`                                    |
 | `selfManaged.otelCollector.enabled`           | Enable OTel collector sidecar for self-managed clusters                                                                                                                              | `false`                                    |
diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json b/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json
index 53cdcbbb6c..e9ef52d0c5 100644
--- a/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json
+++ b/src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json
@@ -1021,6 +1021,11 @@
                     "default": [],
                     "items": {}
                 },
+                "region": {
+                    "type": "string",
+                    "description": "Region reported for a self-managed cluster.",
+                    "default": "us-west-1"
+                },
                 "imageCredHelper": {
                     "type": "object",
                     "properties": {
diff --git a/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml b/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml
index e994203f58..725bb4fa62 100644
--- a/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml
+++ b/src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml
@@ -438,6 +438,8 @@ selfManaged:
   gpuManualInstanceConfigB64: ""
   ## @param selfManaged.clusterAttributes (Optional) List of attributes for the cluster. Defaults to an empty array.
   clusterAttributes: []
+  ## @param selfManaged.region Region reported for a self-managed cluster.
+  region: us-west-1
   ## @param selfManaged.imageCredHelper.imageRepository (OPTIONAL) Image repository of "nvcf-image-credential-helper". Only override this if you know what you are doing. If not specified, it will be calculated based on image.repository.
   ## @param selfManaged.imageCredHelper.imageTag (REQUIRED) Image tag of "nvcf-image-credential-helper". Only override this if you know what you are doing.
   imageCredHelper:
diff --git a/tests/bdd/features/multi-cluster-eks-helmfile.feature b/tests/bdd/features/multi-cluster-eks-helmfile.feature
index cf8856894a..4417ebfc5b 100644
--- a/tests/bdd/features/multi-cluster-eks-helmfile.feature
+++ b/tests/bdd/features/multi-cluster-eks-helmfile.feature
@@ -330,8 +330,8 @@ Feature: Install a multi-cluster NVCF stack across two pre-provisioned EKS clust
       And yaml file "deploy/stacks/nvcf-compute-plane/registration/${EKS_COMPUTE_CLUSTER_NAME}-register-values.yaml" should contain:
         """
         ncaID: nvcf-default
-        region: ${EKS_REGION}
         selfManaged:
+          region: ${EKS_REGION}
           identitySource: psat
         """
       And yaml file "deploy/stacks/nvcf-compute-plane/registration/${EKS_COMPUTE_CLUSTER_NAME}-register-values.yaml" should have non-empty keys:
diff --git a/tests/bdd/features/multi-cluster-helmfile.feature b/tests/bdd/features/multi-cluster-helmfile.feature
index c8d481c4d3..e2d9d1ce9f 100644
--- a/tests/bdd/features/multi-cluster-helmfile.feature
+++ b/tests/bdd/features/multi-cluster-helmfile.feature
@@ -243,8 +243,8 @@ Feature: Install a local multi-cluster NVCF stack with Helmfile
       And yaml file "deploy/stacks/nvcf-compute-plane/registration/ncp-local-compute-1-register-values.yaml" should contain:
         """
         ncaID: nvcf-default
-        region: us-west-1
         selfManaged:
+          region: us-west-1
           identitySource: psat
         """
       And yaml file "deploy/stacks/nvcf-compute-plane/registration/ncp-local-compute-1-register-values.yaml" should have non-empty keys:
diff --git a/tests/bdd/features/multi-cluster-up.feature b/tests/bdd/features/multi-cluster-up.feature
index a2e88e16cf..e2af85a57a 100644
--- a/tests/bdd/features/multi-cluster-up.feature
+++ b/tests/bdd/features/multi-cluster-up.feature
@@ -156,8 +156,8 @@ Feature: Bring up a local multi-cluster NVCF stack with the CLI
         """
         clusterName: ncp-local-compute-1
         ncaID: nvcf-default
-        region: us-west-1
         selfManaged:
+          region: us-west-1
           icmsServiceURL: http://sis.localhost:8080
           revalServiceURL: http://reval.localhost:8080
           natsURL: nats://nats.localhost:4222
diff --git a/tests/bdd/features/single-cluster-eks-helmfile.feature b/tests/bdd/features/single-cluster-eks-helmfile.feature
index 74026c03d1..62fdb26516 100644
--- a/tests/bdd/features/single-cluster-eks-helmfile.feature
+++ b/tests/bdd/features/single-cluster-eks-helmfile.feature
@@ -257,8 +257,8 @@ Feature: Install a single-cluster NVCF stack on a pre-provisioned EKS cluster wi
       And yaml file "deploy/stacks/nvcf-compute-plane/registration/${EKS_CLUSTER_NAME}-register-values.yaml" should contain:
         """
         ncaID: nvcf-default
-        region: ${EKS_REGION}
         selfManaged:
+          region: ${EKS_REGION}
           identitySource: psat
         """
       And yaml file "deploy/stacks/nvcf-compute-plane/registration/${EKS_CLUSTER_NAME}-register-values.yaml" should have non-empty keys:
diff --git a/tests/bdd/features/single-cluster-helmfile-llm-pki.feature b/tests/bdd/features/single-cluster-helmfile-llm-pki.feature
index 81e579a722..0ec78e7ac4 100644
--- a/tests/bdd/features/single-cluster-helmfile-llm-pki.feature
+++ b/tests/bdd/features/single-cluster-helmfile-llm-pki.feature
@@ -193,7 +193,7 @@ Feature: Install a local single-cluster NVCF stack with PKI-secured LLM transpor
 
       When I run command "helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local -o yaml"
       Then the command exit code should be 0
-      And the command output should contain "stargateQUICInsecure: false"
+      And the command output should not contain "stargateQUICInsecure: true"
       And the command output should contain "trustMode: bundle"
       And the command output should contain "trustBundleFingerprint: sha256:"
 
diff --git a/tests/bdd/features/single-cluster-helmfile.feature b/tests/bdd/features/single-cluster-helmfile.feature
index 077a852563..97236ecce1 100644
--- a/tests/bdd/features/single-cluster-helmfile.feature
+++ b/tests/bdd/features/single-cluster-helmfile.feature
@@ -131,8 +131,8 @@ Feature: Install a local single-cluster NVCF stack with Helmfile
         """
         clusterName: ncp-local
         ncaID: nvcf-default
-        region: us-west-1
         selfManaged:
+          region: us-west-1
           identitySource: psat
           icmsServiceURL: http://api.sis.svc.cluster.local:8080
           revalServiceURL: http://reval.nvcf.svc.cluster.local:8080
diff --git a/tests/bdd/features/single-cluster-up.feature b/tests/bdd/features/single-cluster-up.feature
index 9dd182c9c0..0cdc59b462 100644
--- a/tests/bdd/features/single-cluster-up.feature
+++ b/tests/bdd/features/single-cluster-up.feature
@@ -182,8 +182,8 @@ Feature: Bring up a local single-cluster NVCF stack with the CLI
         """
         clusterName: ncp-local
         ncaID: nvcf-default
-        region: us-west-1
         selfManaged:
+          region: us-west-1
           icmsServiceURL: http://api.sis.svc.cluster.local:8080
           revalServiceURL: http://reval.nvcf.svc.cluster.local:8080
           natsURL: nats://nats.nats-system.svc.cluster.local:4222
diff --git a/tests/bdd/fixtures/ncp-local-register-values.yaml b/tests/bdd/fixtures/ncp-local-register-values.yaml
index 27b4ce2672..eb4318e55d 100644
--- a/tests/bdd/fixtures/ncp-local-register-values.yaml
+++ b/tests/bdd/fixtures/ncp-local-register-values.yaml
@@ -4,10 +4,7 @@
 # Stable compute-plane registration handoff for render-only BDD scenarios.
 clusterID: 11111111-2222-3333-4444-555555555555
 clusterGroupID: aaaa-bbbb-cccc-dddd
-ncaID: nvcf-default
-region: us-west-1
 selfManaged:
-  identitySource: psat
   icmsServiceURL: http://api.sis.svc.cluster.local:8080
   revalServiceURL: http://reval.nvcf.svc.cluster.local:8080
   natsURL: nats://nats.nats-system.svc.cluster.local:4222
diff --git a/tests/bdd/fixtures/nvcf-compute-plane-local-bdd-multi.yaml b/tests/bdd/fixtures/nvcf-compute-plane-local-bdd-multi.yaml
index a3c6382074..b70f439ab0 100644
--- a/tests/bdd/fixtures/nvcf-compute-plane-local-bdd-multi.yaml
+++ b/tests/bdd/fixtures/nvcf-compute-plane-local-bdd-multi.yaml
@@ -10,9 +10,6 @@
 # Services in the compute cluster, and the alias Endpoints point at
 # the control-plane load balancer.
 global:
-  nodeSelectors:
-    enabled: false
-
   # REPLACE_WITH_SAMPLE_NGC_ORG / REPLACE_WITH_SAMPLE_NGC_TEAM
   # are overwritten by the feature's Background via
   # `I update yaml file ... with keys:` using ${SAMPLE_NGC_ORG} and
@@ -43,11 +40,3 @@ global:
 # Local BDD does not install the optional observability stack.
 observability:
   profile: disabled
-
-agentConfig:
-  mergeConfig: |
-    cluster:
-      validationPolicy:
-        name: Unrestricted
-    workload:
-      stargateQUICInsecure: false
diff --git a/tests/bdd/fixtures/nvcf-compute-plane-local-bdd.yaml b/tests/bdd/fixtures/nvcf-compute-plane-local-bdd.yaml
index b3896eaf90..f3869b1ad3 100644
--- a/tests/bdd/fixtures/nvcf-compute-plane-local-bdd.yaml
+++ b/tests/bdd/fixtures/nvcf-compute-plane-local-bdd.yaml
@@ -12,9 +12,6 @@
 # does not resolve, which is the intended failure mode.
 
 global:
-  nodeSelectors:
-    enabled: false
-
   helm:
     sources:
       repository: "REPLACE_WITH_SAMPLE_NGC_ORG/REPLACE_WITH_SAMPLE_NGC_TEAM"
@@ -37,11 +34,3 @@ global:
 # Local BDD does not install the optional observability stack.
 observability:
   profile: disabled
-
-agentConfig:
-  mergeConfig: |
-    cluster:
-      validationPolicy:
-        name: Unrestricted
-    workload:
-      stargateQUICInsecure: false
diff --git a/tests/bdd/fixtures_test.go b/tests/bdd/fixtures_test.go
index 3f5f3f0c2e..35259e874d 100644
--- a/tests/bdd/fixtures_test.go
+++ b/tests/bdd/fixtures_test.go
@@ -227,7 +227,7 @@ func TestComputePlaneLocalBDDFixturesUseDefaultHelmResourceEnforcement(t *testin
 	}
 }
 
-func TestComputePlaneLocalBDDFixturesRequireSecureQUIC(t *testing.T) {
+func TestComputePlaneLocalBDDFixturesDeferNVCAChartDefaults(t *testing.T) {
 	for _, fixturePath := range []string{
 		"fixtures/nvcf-compute-plane-local-bdd.yaml",
 		"fixtures/nvcf-compute-plane-local-bdd-multi.yaml",
@@ -238,6 +238,9 @@ func TestComputePlaneLocalBDDFixturesRequireSecureQUIC(t *testing.T) {
 				t.Fatalf("read compute-plane fixture %s: %v", fixturePath, err)
 			}
 			var fixture struct {
+				Global struct {
+					NodeSelectors map[string]any `yaml:"nodeSelectors"`
+				} `yaml:"global"`
 				AgentConfig struct {
 					MergeConfig string `yaml:"mergeConfig"`
 				} `yaml:"agentConfig"`
@@ -245,24 +248,47 @@ func TestComputePlaneLocalBDDFixturesRequireSecureQUIC(t *testing.T) {
 			if err := yaml.Unmarshal(fixtureBytes, &fixture); err != nil {
 				t.Fatalf("parse compute-plane fixture %s: %v", fixturePath, err)
 			}
-			var mergeConfig struct {
-				Workload struct {
-					StargateQUICInsecure *bool `yaml:"stargateQUICInsecure"`
-				} `yaml:"workload"`
-			}
-			if err := yaml.Unmarshal([]byte(fixture.AgentConfig.MergeConfig), &mergeConfig); err != nil {
-				t.Fatalf("parse agent merge config in %s: %v", fixturePath, err)
-			}
-			if mergeConfig.Workload.StargateQUICInsecure == nil {
-				t.Fatalf("%s does not set workload.stargateQUICInsecure", fixturePath)
+			if len(fixture.Global.NodeSelectors) != 0 {
+				t.Fatalf("%s contains inert global.nodeSelectors values", fixturePath)
 			}
-			if *mergeConfig.Workload.StargateQUICInsecure {
-				t.Fatalf("%s enables insecure QUIC with profile-provided bundle trust", fixturePath)
+			if fixture.AgentConfig.MergeConfig != "" {
+				t.Fatalf("%s shadows NVCA chart defaults with agentConfig.mergeConfig", fixturePath)
 			}
 		})
 	}
 }
 
+func TestNCPRegistrationFixtureDefersNVCAChartAndStackDefaults(t *testing.T) {
+	fixtureBytes, err := os.ReadFile("fixtures/ncp-local-register-values.yaml")
+	if err != nil {
+		t.Fatalf("read registration fixture: %v", err)
+	}
+	var fixture struct {
+		NCAID       string `yaml:"ncaID"`
+		Region      string `yaml:"region"`
+		SelfManaged struct {
+			Region         string `yaml:"region"`
+			IdentitySource string `yaml:"identitySource"`
+			ICMSServiceURL string `yaml:"icmsServiceURL"`
+		} `yaml:"selfManaged"`
+	}
+	if err := yaml.Unmarshal(fixtureBytes, &fixture); err != nil {
+		t.Fatalf("parse registration fixture: %v", err)
+	}
+	if fixture.NCAID != "" {
+		t.Fatalf("registration fixture masks the stack ncaID mapping with %q", fixture.NCAID)
+	}
+	if fixture.Region != "" || fixture.SelfManaged.Region != "" {
+		t.Fatal("registration fixture overrides the chart selfManaged.region default")
+	}
+	if fixture.SelfManaged.IdentitySource != "" {
+		t.Fatal("render-only registration fixture contains CLI lifecycle metadata")
+	}
+	if fixture.SelfManaged.ICMSServiceURL == "" {
+		t.Fatal("registration fixture must retain its topology-specific ICMS endpoint")
+	}
+}
+
 func TestSelfManagedLocalBDDMultiFixtureWiresComputeReachableWorkerEndpoints(t *testing.T) {
 	fixtureBytes, err := os.ReadFile("fixtures/self-managed-local-bdd-multi.yaml")
 	if err != nil {
diff --git a/tests/bdd/godog_test.go b/tests/bdd/godog_test.go
index 513fac10a9..1059b1f74c 100644
--- a/tests/bdd/godog_test.go
+++ b/tests/bdd/godog_test.go
@@ -195,8 +195,8 @@ func writeMulticlusterComputeRegisterValues(t *testing.T, repoRoot, stackDir, cl
 clusterID: 99999999-aaaa-bbbb-cccc-dddddddddddd
 clusterGroupID: cccc-dddd-eeee-ffff
 ncaID: nvcf-default
-region: us-west-1
 selfManaged:
+  region: us-west-1
   identitySource: psat
   icmsServiceURL: http://sis.localhost:8080
   revalServiceURL: http://reval.localhost:8080
@@ -219,8 +219,8 @@ func writeSingleClusterComputeRegisterValues(t *testing.T, repoRoot string) {
 clusterID: 11111111-2222-3333-4444-555555555555
 clusterGroupID: aaaa-bbbb-cccc-dddd
 ncaID: nvcf-default
-region: us-west-1
 selfManaged:
+  region: us-west-1
   identitySource: psat
   icmsServiceURL: http://api.sis.svc.cluster.local:8080
   revalServiceURL: http://reval.nvcf.svc.cluster.local:8080
@@ -240,8 +240,8 @@ func writeHelmfileRegisterValues(t *testing.T, repoRoot string) {
 clusterID: 11111111-2222-3333-4444-555555555555
 clusterGroupID: aaaa-bbbb-cccc-dddd
 ncaID: nvcf-default
-region: us-west-1
 selfManaged:
+  region: us-west-1
   identitySource: psat
   icmsServiceURL: http://api.sis.svc.cluster.local:8080
   revalServiceURL: http://reval.nvcf.svc.cluster.local:8080
@@ -678,7 +678,7 @@ func TestSingleClusterHelmfileLLMPKIFeatureFileWiresToSteps(t *testing.T) {
 		},
 		"helm get values nvca-operator --namespace nvca-operator --kube-context k3d-ncp-local -o yaml": {
 			ExitCode: 0,
-			Stdout:   "agentConfig:\n  mergeConfig: |\n    workload:\n      stargateQUICInsecure: false\n      transportTLS:\n        trustMode: bundle\n        trustBundleFingerprint: sha256:test\n",
+			Stdout:   "agentConfig:\n  mergeConfig: |\n    workload:\n      transportTLS:\n        trustMode: bundle\n        trustBundleFingerprint: sha256:test\n",
 		},
 		"/usr/bin/nvcf-cli --config /repo-root-placeholder/tests/bdd/fixtures/nvcf-cli-local.yaml function invoke" +
 			" --inference-url /v1/chat/completions --model-name openai-compatible-sample" +
@@ -1583,7 +1583,7 @@ func TestMultiClusterHelmfileLLMRegistrationTLSFeatureFileWiresToSteps(t *testin
 	t.Setenv("REPO_ROOT", "/repo-root-placeholder")
 
 	const (
-		tlsHandshakeCommand     = `/bin/bash -c 'openssl s_client -connect 127.0.0.1:50071 ` +
+		tlsHandshakeCommand = `/bin/bash -c 'openssl s_client -connect 127.0.0.1:50071 ` +
 			`-servername llm-request-router.nvcf.svc.cluster.local -alpn h2 -verify_return_error ` +
 			`-CAfile <(kubectl --context k3d-ncp-local-cp get secret stargate-quic-tls -n nvcf ` +
 			`-o jsonpath="{.data.ca\.crt}" | base64 -d) </dev/null 2>&1'`
@@ -2059,8 +2059,6 @@ ingress:
 func seedComputePlaneLocalBDDFixture(t *testing.T, repoRoot string) {
 	t.Helper()
 	writeFixture(t, repoRoot, "nvcf-compute-plane-local-bdd.yaml", `global:
-  nodeSelectors:
-    enabled: false
   nvcaOperator:
     selfManaged:
       icmsServiceURL: http://api.sis.svc.cluster.local:8080
@@ -2068,21 +2066,12 @@ func seedComputePlaneLocalBDDFixture(t *testing.T, repoRoot string) {
       natsURL: nats://nats.nats-system.svc.cluster.local:4222
 observability:
   profile: disabled
-agentConfig:
-  mergeConfig: |
-    cluster:
-      validationPolicy:
-        name: Unrestricted
-    workload:
-      stargateQUICInsecure: false
 `)
 }
 
 func seedComputePlaneLocalBDDMultiFixture(t *testing.T, repoRoot string) {
 	t.Helper()
 	writeFixture(t, repoRoot, "nvcf-compute-plane-local-bdd-multi.yaml", `global:
-  nodeSelectors:
-    enabled: false
   nvcaOperator:
     selfManaged:
       icmsServiceURL: http://api.sis.svc.cluster.local:8080
@@ -2090,13 +2079,6 @@ func seedComputePlaneLocalBDDMultiFixture(t *testing.T, repoRoot string) {
       natsURL: nats://nats.nats-system.svc.cluster.local:4222
 observability:
   profile: disabled
-agentConfig:
-  mergeConfig: |
-    cluster:
-      validationPolicy:
-        name: Unrestricted
-    workload:
-      stargateQUICInsecure: false
 `)
 }
 
@@ -2165,8 +2147,8 @@ func writeEKSRegisterValues(t *testing.T, repoRoot, clusterName, region string)
 	body := `clusterID: 11111111-2222-3333-4444-555555555555
 clusterGroupID: aaaa-bbbb-cccc-dddd
 ncaID: nvcf-default
-region: ` + region + `
 selfManaged:
+  region: ` + region + `
   identitySource: psat
   icmsServiceURL: http://wiring-elb.example.invalid
   revalServiceURL: http://wiring-elb.example.invalid