diff --git a/deploy/helm/openshell/templates/_helpers.tpl b/deploy/helm/openshell/templates/_helpers.tpl
index 30c0275765..5872dc4043 100644
--- a/deploy/helm/openshell/templates/_helpers.tpl
+++ b/deploy/helm/openshell/templates/_helpers.tpl
@@ -144,6 +144,24 @@ init-container
 {{- end -}}
 {{- end }}
 
+{{/*
+Default server certificate DNS SANs derived from the release name and namespace.
+Returns a YAML list. Append extra SANs from values with range loops.
+*/}}
+{{- define "openshell.defaultServerDnsNames" -}}
+{{- $name := include "openshell.fullname" . -}}
+{{- $ns := .Release.Namespace -}}
+{{- list $name
+      (printf "%s.%s.svc" $name $ns)
+      (printf "%s.%s.svc.cluster.local" $name $ns)
+      "localhost"
+      (printf "%s.localhost" $name)
+      (printf "*.%s.localhost" $name)
+      "host.docker.internal"
+      "host.containers.internal"
+  | toYaml }}
+{{- end }}
+
 {{/*
 Gateway workload kind. StatefulSet is the default because the default SQLite
 database requires persistent per-pod storage.
diff --git a/deploy/helm/openshell/templates/cert-manager-pki.yaml b/deploy/helm/openshell/templates/cert-manager-pki.yaml
index 43a19d5f55..fdd702a305 100644
--- a/deploy/helm/openshell/templates/cert-manager-pki.yaml
+++ b/deploy/helm/openshell/templates/cert-manager-pki.yaml
@@ -55,7 +55,12 @@ spec:
   renewBefore: {{ .Values.certManager.certificateRenewBefore | quote }}
   commonName: openshell-server
   dnsNames:
-    {{- toYaml .Values.certManager.serverDnsNames | nindent 4 }}
+    {{- range (include "openshell.defaultServerDnsNames" . | fromYamlArray) }}
+    - {{ . | quote }}
+    {{- end }}
+    {{- range .Values.certManager.serverDnsNames }}
+    - {{ . | quote }}
+    {{- end }}
   {{- if .Values.certManager.serverIpAddresses }}
   ipAddresses:
     {{- toYaml .Values.certManager.serverIpAddresses | nindent 4 }}
diff --git a/deploy/helm/openshell/templates/certgen.yaml b/deploy/helm/openshell/templates/certgen.yaml
index 3651e188f5..c4f2d74e85 100644
--- a/deploy/helm/openshell/templates/certgen.yaml
+++ b/deploy/helm/openshell/templates/certgen.yaml
@@ -103,6 +103,10 @@ spec:
             {{- end }}
             - --jwt-secret-name={{ include "openshell.sandboxJwtSecretName" . }}
             {{- if and .Values.pkiInitJob.enabled (not .Values.certManager.enabled) }}
+            {{- range (include "openshell.defaultServerDnsNames" . | fromYamlArray) }}
+            - --server-san={{ . }}
+            {{- end }}
+            - --server-san=127.0.0.1
             {{- range .Values.pkiInitJob.serverDnsNames }}
             - --server-san={{ . }}
             {{- end }}