diff --git a/apps/ams-sync/wb/kustomization.yaml b/apps/ams-sync/wb/kustomization.yaml
new file mode 100644
index 0000000..66ac7e4
--- /dev/null
+++ b/apps/ams-sync/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ams-sync
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: ams-sync
diff --git a/apps/ams-sync/wb/patch.yaml b/apps/ams-sync/wb/patch.yaml
new file mode 100644
index 0000000..c02da1c
--- /dev/null
+++ b/apps/ams-sync/wb/patch.yaml
@@ -0,0 +1,55 @@
+---
+# Патч для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/ams-sync/base/helmrelease.yaml.
+#
+# В base image-тег и USER_SERVER_HOST/AUTH_HOST зашиты под другого клиента
+# (sarex.ugok.lan, образ ams-sync:ugok) — для wb это srx.wb.ru.
+# secretEnvs (telegram/zitadel/kafka/db) не трогаем — они читаются из обычных
+# k8s Secret'ов (не vault-agent), которые в wb уже должны быть заведены отдельно.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ams-sync
+  namespace: ams-sync
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: AMS_SYNC_TOPIC
+            value:
+              _default: "ams-sync"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "PRODUCTION"
+
+          - name: HOST_ORGANIZATION_ID
+            value:
+              _default: "368536846176636704"
+
+          - name: ALERT_ENABLED
+            value:
+              _default: "False"
+
+          - name: USER_SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AUTH_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: VERIFY_USERS
+            value:
+              _default: "True"
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
diff --git a/apps/attachments/wb/kustomization.yaml b/apps/attachments/wb/kustomization.yaml
new file mode 100644
index 0000000..6fae072
--- /dev/null
+++ b/apps/attachments/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: attachments
diff --git a/apps/attachments/wb/patch.yaml b/apps/attachments/wb/patch.yaml
new file mode 100644
index 0000000..0fcba12
--- /dev/null
+++ b/apps/attachments/wb/patch.yaml
@@ -0,0 +1,40 @@
+---
+# Эндпоинт MinIO для контура wb.
+#
+# В base зашит YANDEX_S3_ENDPOINT_URL=minio.minio:9000 — заглушка, недоступная
+# в кластере wb. Реальный адрес/бакет — из terraform 1.yaml (infrastructure.minio.apps.attachments
+# для wb): client.endpoint=http://10.49.10.90:9000, buckets[0].name=sarex-media-storage.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+spec:
+  values:
+    services:
+      attachments:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: attachments
+            vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
+            vault.hashicorp.com/agent-inject-template-attachments-db: |-
+              {{- with secret "secrets/data/apps/attachments/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              DATABASE_SSL_MODE=disable
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
+            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
+              {{- with secret "secrets/data/minio/apps/attachments" -}}
+              YANDEX_S3_ENDPOINT_URL=10.49.10.90:9000
+              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YANDEX_S3_USE_SSL=false
+              YANDEX_S3_REGION=ru-central
+              YANDEX_S3_VERIFY=false
+              BUCKET_NAME=sarex-media-storage
+              {{- end -}}
diff --git a/apps/bim/wb/kustomization.yaml b/apps/bim/wb/kustomization.yaml
new file mode 100644
index 0000000..3342d19
--- /dev/null
+++ b/apps/bim/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bim
+resources:
+  - ../base
diff --git a/apps/checklists/wb/kustomization.yaml b/apps/checklists/wb/kustomization.yaml
new file mode 100644
index 0000000..14638e2
--- /dev/null
+++ b/apps/checklists/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: checklists
+resources:
+  - ../base
diff --git a/apps/comparisons/wb/backend.yaml b/apps/comparisons/wb/backend.yaml
new file mode 100644
index 0000000..906cae9
--- /dev/null
+++ b/apps/comparisons/wb/backend.yaml
@@ -0,0 +1,94 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "comparisons"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOGGER_LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "postgres"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://documentations-service.documentations"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/documentations"
+
+          - name: DOCUMENTATION_FILESTREAM_URL
+            value:
+              _default: "http://backend-filestream-svc.documentations.svc.cluster.local/"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-service.workflow"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://workspaces-service.workspaces"
+
+          - name: EAV_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/eav"
+
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "94015"
+
+          - name: LAST_SLAVE_2_BIM
+            value:
+              _default: "135771"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"
diff --git a/apps/comparisons/wb/kustomization.yaml b/apps/comparisons/wb/kustomization.yaml
new file mode 100644
index 0000000..f48a1f4
--- /dev/null
+++ b/apps/comparisons/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: comparisons
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
diff --git a/apps/contracts/wb/kustomization.yaml b/apps/contracts/wb/kustomization.yaml
new file mode 100644
index 0000000..ce4670f
--- /dev/null
+++ b/apps/contracts/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: contracts
+resources:
+  - ../base
diff --git a/apps/django/wb/backend.yaml b/apps/django/wb/backend.yaml
new file mode 100644
index 0000000..09e5b7b
--- /dev/null
+++ b/apps/django/wb/backend.yaml
@@ -0,0 +1,167 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/django/base/backend.yaml.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# agent-inject-template-django-s3; остальные vault-аннотации берутся из base.
+#
+# В base SERVER_API_HOST/SERVER_HOST/ZITADEL_HOST/S3 смотрят на тестовый
+# контур contour.infra.sarex.tech — для wb это srx.wb.ru / zitadel-srx.wb.ru
+# (см. apps/documentations/base — там те же домены уже дефолт) и свой MinIO
+# (terraform 1.yaml, infrastructure.minio.apps.django для wb: client.endpoint=http://10.49.10.90:9000).
+# WORKFLOWS_HOST в base смотрит на ns processing — в wb processing развёрнут
+# в ns workflow (apps/processing/wb), поэтому тоже поправлен.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://srx.wb.ru
+          - name: SERVER_HOST
+            value:
+              _default: https://srx.wb.ru
+          - name: WORKFLOWS_HOST
+            value:
+              _default: http://backend-svc.workflow.svc.cluster.local:80
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: WORKFLOWS_PREFIX
+            value:
+              _default: /internal/v1
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://zitadel-srx.wb.ru
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-django-s3: |-
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_S3_ENDPOINT_URL=http://10.49.10.90:9000
+              S3_HOST=http://10.49.10.90:9000
+              {{- $buckets := index .Data.data "buckets" }}
+              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              S3_LOGIN={{ index .Data.data "access_key" }}
+              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              {{- end }}
diff --git a/apps/django/wb/kustomization.yaml b/apps/django/wb/kustomization.yaml
new file mode 100644
index 0000000..84e0533
--- /dev/null
+++ b/apps/django/wb/kustomization.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: zitadel-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: zitadel-configmap
+  - path: s3-proxy.yaml
+    target:
+      kind: HelmRelease
+      name: s3-proxy
+  - path: nginx-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: nginx-configmap
diff --git a/apps/django/wb/nginx-configmap.yaml b/apps/django/wb/nginx-configmap.yaml
new file mode 100644
index 0000000..9c179f2
--- /dev/null
+++ b/apps/django/wb/nginx-configmap.yaml
@@ -0,0 +1,171 @@
+---
+# В base nginx проксирует /workflows/ на frontend-svc.processing — в wb
+# processing развёрнут в ns workflow (apps/processing/wb), поэтому правим
+# proxy_pass. ConfigMap.data — карта с единственным ключом nginx.conf, значит
+# приходится продублировать содержимое целиком (map мержится по ключам, но
+# ключ тут один и это цельная строка).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        # server_tokens off;
+        # server_names_hash_bucket_size 64;
+        # server_name_in_redirect off;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' '*' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            location ~^/api/pm/ {
+                #rewrite /api/(.+) /$1 break;
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }
+
+            location ~^/api/v1/documents/ {
+                proxy_http_version 1.1;
+                #rewrite /api/(.+) /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
+            }
+
+            location ~^/(api|admin)/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.django.svc.cluster.local:80;
+            }
+
+
+            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
+                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
+                add_header Content-Type application/wasm always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
+                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
+                add_header Content-Type application/wasm always;
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
+            }
+
+             location ~^/workspaces-v2/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite /workspaces-v2/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            }
+
+            location ~^/workspaces-v2/(.+)\.wasm$ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite ^/workspaces-v2/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            location ~^/workflows/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite /workflows/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workflow.svc.cluster.local:80;
+            }
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }
diff --git a/apps/django/wb/s3-proxy.yaml b/apps/django/wb/s3-proxy.yaml
new file mode 100644
index 0000000..acff88c
--- /dev/null
+++ b/apps/django/wb/s3-proxy.yaml
@@ -0,0 +1,26 @@
+---
+# Патч s3-proxy для контура wb.
+#
+# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
+# недоступен в wb. Эндпоинт задан литералом, а не через .Data.data.client.endpoint,
+# так же как в apps/django/wb/backend.yaml для того же секрета
+# secrets/data/minio/apps/django — держим один способ на весь ns.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+spec:
+  values:
+    services:
+      s3-proxy:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-s3: |
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_API_ENDPOINT=http://10.49.10.90:9000
+              {{- $buckets := index .Data.data "buckets" }}
+              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end }}
diff --git a/apps/django/wb/zitadel-configmap.yaml b/apps/django/wb/zitadel-configmap.yaml
new file mode 100644
index 0000000..bf184ad
--- /dev/null
+++ b/apps/django/wb/zitadel-configmap.yaml
@@ -0,0 +1,19 @@
+---
+# Хост Zitadel для wb — zitadel-srx.wb.ru (подтверждено).
+# client_id пока оставлен от base (тестовый контур) — это ID OAuth-клиента,
+# зарегистрированного в конкретном Zitadel-инстансе, его нужно завести/уточнить
+# отдельно для zitadel-srx.wb.ru перед реальным включением django на wb.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-configmap
+  namespace: django
+data:
+  config.json: |
+    {
+      "auth_type": "zitadel",
+      "zitadel": {
+        "client_id": "379557107642492501",
+        "host": "https://zitadel-srx.wb.ru"
+      }
+    }
diff --git a/apps/documentations/wb/api.yaml b/apps/documentations/wb/api.yaml
new file mode 100644
index 0000000..5eb6500
--- /dev/null
+++ b/apps/documentations/wb/api.yaml
@@ -0,0 +1,170 @@
+---
+# Патч documentations-api для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/documentations/base/api.yaml.
+#
+# В base WORKSPACE_V2_EXTERNAL_URL и FILE_STREAM_HOST почему-то остались на
+# тестовом контуре contour.infra.sarex.tech, хотя соседний
+# apps/documentations/base/filestream.yaml для тех же полей уже использует
+# srx.wb.ru — берём то же значение (рассинхрон между api.yaml и
+# filestream.yaml в base, не имеет отношения к ugmk-патчам).
+# WORKFLOW_URL в base смотрит на ns processing — в wb processing развёрнут
+# в ns workflow (apps/processing/wb), тоже поправлено.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: zitadel-srx.wb.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://srx.wb.ru/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: srx.wb.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.workflow.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://backend-svc.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: "true"
+          - name: MARKS_RABBITMQ_HOST
+            value:
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+          - name: MARKS_RABBITMQ_PORT
+            value:
+              _default: "5672"
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link-srx.wb.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "true"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "false"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
diff --git a/apps/documentations/wb/kustomization.yaml b/apps/documentations/wb/kustomization.yaml
new file mode 100644
index 0000000..5e3cbd4
--- /dev/null
+++ b/apps/documentations/wb/kustomization.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: documentations
+resources:
+  - ../base
+patches:
+  - path: api.yaml
+    target:
+      kind: HelmRelease
+      name: documentations-api
+  - path: pdm.yaml
+    target:
+      kind: HelmRelease
+      name: pdm-api
diff --git a/apps/documentations/wb/pdm.yaml b/apps/documentations/wb/pdm.yaml
new file mode 100644
index 0000000..1341285
--- /dev/null
+++ b/apps/documentations/wb/pdm.yaml
@@ -0,0 +1,176 @@
+---
+# Патч pdm-api для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/documentations/base/pdm.yaml.
+# Единственное изменение — WORKFLOW_URL: в base смотрит на ns processing,
+# в wb processing развёрнут в ns workflow (apps/processing/wb).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: USE_EXPERIMENTAL
+            value:
+              _default: "true"
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: mock
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: BUCKET_NAME
+            value:
+              _default: attachments-storage
+          - name: API_HOST_PREFIX
+            value:
+              _default: /
+          - name: APP_NAME
+            value:
+              _default: pdm_v2
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: http://drawings-api-service.drawings.svc.cluster.local:80
+          - name: ATTACHMENTS_URL
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:8000
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: BIM_V2_HOST
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENVIRONMENT
+            value:
+              _default: prod
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+          - name: INSPECTIONS_URL
+            value:
+              _default: http://inspections-service.inspections.svc.cluster.local:80
+          - name: LOG_LEVEL
+            value:
+              _default: INFO
+          - name: NOTES_URL
+            value:
+              _default: ""
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: temp
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: RELEASES_URL
+            value:
+              _default: https://gitlab.com
+          - name: REMARKS_URL
+            value:
+              _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
+          - name: RESOURCES_URL
+            value:
+              _default: http://iam-backend.iam.svc.cluster.local:8000
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: STATES_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: http://backend-svc.subscriptions.svc.cluster.local:80
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: TARGET_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: RELEASES_TOKEN
+            value:
+              _default: "mock"
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.workflow.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
diff --git a/apps/drawings/wb/kustomization.yaml b/apps/drawings/wb/kustomization.yaml
new file mode 100644
index 0000000..fd6815f
--- /dev/null
+++ b/apps/drawings/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: drawings
+resources:
+  - ../base
diff --git a/apps/eav/wb/kustomization.yaml b/apps/eav/wb/kustomization.yaml
new file mode 100644
index 0000000..1ce8404
--- /dev/null
+++ b/apps/eav/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eav
+resources:
+  - ../base
diff --git a/apps/faas/wb/backend.yaml b/apps/faas/wb/backend.yaml
new file mode 100644
index 0000000..5bf59e4
--- /dev/null
+++ b/apps/faas/wb/backend.yaml
@@ -0,0 +1,74 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/faas/base/backend.yaml.
+#
+# В base BASE_HOST/DJANGO_HOST/REVIEWS_HOST/GATEWAY_HOST/DOCUMENTATIONS_HOST
+# смотрят на тестовый контур contour.infra.sarex.tech — для wb это srx.wb.ru
+# (ugmk эти поля тоже не переопределял — тот же неисправленный дефолт).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-reviews
+  namespace: faas
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: REVIEWS_HOST
+            value:
+              _default: "https://srx.wb.ru/flows"
+
+          - name: GATEWAY_HOST
+            value:
+              _default: "https://srx.wb.ru/gateway"
+
+          - name: DOCUMENTATIONS_HOST
+            value:
+              _default: "https://srx.wb.ru/documentations"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: TRANSMITTALS_INTERNAL_HOST
+            value:
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80/internal/v1"
+
+          - name: DJANGO_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: REVIEWS_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: GATEWAY_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATIONS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTALS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TIMEOUT
+            value:
+              _default: "180"
diff --git a/apps/faas/wb/kustomization.yaml b/apps/faas/wb/kustomization.yaml
new file mode 100644
index 0000000..dfaf222
--- /dev/null
+++ b/apps/faas/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: faas
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: export-reviews
diff --git a/apps/flows/wb/backend.yaml b/apps/flows/wb/backend.yaml
new file mode 100644
index 0000000..9f9bb4d
--- /dev/null
+++ b/apps/flows/wb/backend.yaml
@@ -0,0 +1,116 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
+# Единственное изменение — WORKFLOWS_HOST: в base смотрит на ns processing,
+# в wb processing развёрнут в ns workflow (apps/processing/wb).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: flows
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80/api"
+
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "sarex@rwb.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-svc.documentations.svc.cluster.local:80"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://srx.wb.ru/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "mail.rwb.ru"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
+          - name: SMTP_PORT
+            value:
+              _default: "465"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
diff --git a/apps/flows/wb/kustomization.yaml b/apps/flows/wb/kustomization.yaml
new file mode 100644
index 0000000..e90dac9
--- /dev/null
+++ b/apps/flows/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flows
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
diff --git a/apps/iam/wb/backend-s3.yaml b/apps/iam/wb/backend-s3.yaml
new file mode 100644
index 0000000..737f19a
--- /dev/null
+++ b/apps/iam/wb/backend-s3.yaml
@@ -0,0 +1,87 @@
+---
+# В base S3_ENDPOINT_URL смотрит на storage.yandexcloud.net (Яндекс.Облако) —
+# в wb используется собственный self-hosted MinIO.
+# ZITADEL_HOST в base (sarex-login.uralmine.com) не трогаем: это общий
+# платформенный SSO для iam, не переопределяется ни в одном клиентском контуре.
+#
+# TODO: для iam в vault wb (1.yaml) ещё не заведён infrastructure.minio.apps.iam
+# (нет реального client.endpoint/bucket, в отличие от attachments/django/...) —
+# 10.49.10.90:9000 здесь взят по аналогии с остальными приложениями wb.
+# Проверить/поправить, когда в vault появится бакет для iam.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: iam-backend
+  namespace: iam
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "debug"
+
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: HTTP_READ_BUFFER_SIZE
+            value:
+              _default: "131072"
+
+          - name: DB_MIGRATIONS_PATH
+            value:
+              _default: "migrations"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://sarex-login.uralmine.com"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: S3_ENABLED
+            value:
+              _default: "true"
+
+          - name: S3_ENDPOINT_URL
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: S3_BUCKET_NAME
+            value:
+              _default: "sarex-media-storage"
+
+          - name: S3_REGION
+            value:
+              _default: "ru-central1"
+
+          - name: S3_PRESIGN_EXPIRES
+            value:
+              _default: "1h"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "false"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/etc/ca-certificates/Yandex/ca-cert"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"
diff --git a/apps/iam/wb/kustomization.yaml b/apps/iam/wb/kustomization.yaml
new file mode 100644
index 0000000..b7686d1
--- /dev/null
+++ b/apps/iam/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: iam
+resources:
+  - ../base
+patches:
+  - path: backend-s3.yaml
+    target:
+      kind: HelmRelease
+      name: iam-backend
diff --git a/apps/inspections/wb/backend.yaml b/apps/inspections/wb/backend.yaml
new file mode 100644
index 0000000..c1a1cc9
--- /dev/null
+++ b/apps/inspections/wb/backend.yaml
@@ -0,0 +1,112 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/inspections/base/backend.yaml.
+# Единственное изменение — WORKFLOWS_URL: в base смотрит на ns processing,
+# в wb processing развёрнут в ns workflow (apps/processing/wb).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: inspections
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: SERVICE_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/inspections"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "3"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SAREX_BACKEND_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: EAV_URL
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
+
+          - name: MOBILE_APP_CURRENT_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_RECOMMENDED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_REQUIRED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MAILER_URL
+            value:
+              _default: "http://mailer-service.mailer:8000"
+
+          - name: MAILER_TIMEOUT
+            value:
+              _default: "30"
diff --git a/apps/inspections/wb/kustomization.yaml b/apps/inspections/wb/kustomization.yaml
new file mode 100644
index 0000000..e278709
--- /dev/null
+++ b/apps/inspections/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: inspections
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
diff --git a/apps/issues/wb/backend.yaml b/apps/issues/wb/backend.yaml
new file mode 100644
index 0000000..5756181
--- /dev/null
+++ b/apps/issues/wb/backend.yaml
@@ -0,0 +1,85 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# agent-inject-template-issues-s3.
+#
+# В base AERO_*/SAREX_API смотрят на тестовый контур contour.infra.sarex.tech —
+# для wb это srx.wb.ru (apps/issues/base/celery.yaml уже использует его как
+# дефолт — переносим то же значение сюда, в base/backend.yaml почему-то ещё
+# contour). MinIO-бакет в base тоже неверный (rfi вместо issues) — из
+# terraform 1.yaml (infrastructure.minio.apps.issues для wb):
+# client.endpoint=https://minio-srx.wb.ru, buckets[0].name=issues.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: issues
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=https://minio-srx.wb.ru
+              {{- end -}}
diff --git a/apps/issues/wb/celery.yaml b/apps/issues/wb/celery.yaml
new file mode 100644
index 0000000..05bb0e1
--- /dev/null
+++ b/apps/issues/wb/celery.yaml
@@ -0,0 +1,25 @@
+---
+# Патч celery для контура wb.
+#
+# В apps/issues/base/celery.yaml AERO_*/SAREX_API уже "https://srx.wb.ru" —
+# трогать envs не нужно. Но MinIO-бакет в base тоже неверный (rfi вместо
+# issues) — правим только podAnnotations (map, мержится по ключам).
+# См. подробности в apps/issues/wb/backend.yaml.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: issues
+spec:
+  values:
+    services:
+      celery:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=https://minio-srx.wb.ru
+              {{- end -}}
diff --git a/apps/issues/wb/kustomization.yaml b/apps/issues/wb/kustomization.yaml
new file mode 100644
index 0000000..787f553
--- /dev/null
+++ b/apps/issues/wb/kustomization.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: issues
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
diff --git a/apps/message-hub/wb/kustomization.yaml b/apps/message-hub/wb/kustomization.yaml
new file mode 100644
index 0000000..a397afc
--- /dev/null
+++ b/apps/message-hub/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: message-hub
+resources:
+  - ../base
diff --git a/apps/notes/wb/backend.yaml b/apps/notes/wb/backend.yaml
new file mode 100644
index 0000000..44ab0f2
--- /dev/null
+++ b/apps/notes/wb/backend.yaml
@@ -0,0 +1,55 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/notes/base/backend.yaml.
+#
+# DJANGO_HOST/BASE_HOST/FAAS_SERVICE/WORKSPACE_URL/WORKFLOW_HOST/RESOURCE_URL
+# в base смотрят на домен sarex.io (lk.sarex.io, api.sarex.io/<service>) —
+# для wb это lk.srx.wb.ru:30443/<service>, по аналогии с rfi/transmittal.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: notes
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: PG_SSL_MODE
+            value:
+              _default: verify-full
+          - name: DJANGO_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443
+          - name: BASE_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443/notes
+          - name: TIMEOUT
+            value:
+              _default: "120"
+          - name: FAAS_SERVICE
+            value:
+              _default: https://lk.srx.wb.ru:30443/lambdas
+          - name: WORKSPACE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/workspaces/api/v1
+          - name: WORKFLOW_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443/workflows/api/v1
+          - name: WORKFLOW_TAG
+            value:
+              _default: stable
+          - name: RESOURCE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/resources/api/v1
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+          - name: ATTACHMENT_HOST
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1
diff --git a/apps/notes/wb/kustomization.yaml b/apps/notes/wb/kustomization.yaml
new file mode 100644
index 0000000..d2f2ce6
--- /dev/null
+++ b/apps/notes/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: notes
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
diff --git a/apps/pm/wb/kustomization.yaml b/apps/pm/wb/kustomization.yaml
new file mode 100644
index 0000000..ae44f4c
--- /dev/null
+++ b/apps/pm/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pm
+resources:
+  - ../base
diff --git a/apps/processing/wb/kustomization.yaml b/apps/processing/wb/kustomization.yaml
new file mode 100644
index 0000000..744e521
--- /dev/null
+++ b/apps/processing/wb/kustomization.yaml
@@ -0,0 +1,13 @@
+---
+# В wb приложение processing разворачивается в неймспейс workflow (не
+# processing, как в base/ugmk).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: workflow
+resources:
+  - ../base
+patches:
+  - path: rbac.yaml
+    target:
+      kind: RoleBinding
+      name: processing-jobs
diff --git a/apps/processing/wb/rbac.yaml b/apps/processing/wb/rbac.yaml
new file mode 100644
index 0000000..5624315
--- /dev/null
+++ b/apps/processing/wb/rbac.yaml
@@ -0,0 +1,19 @@
+---
+# kustomize сам переименовывает Namespace/Role/RoleBinding в workflow через
+# поле namespace: в kustomization.yaml, но НЕ подставляет новый неймспейс в
+# subjects[].namespace у RoleBinding (это не namespaced-поле верхнего уровня) —
+# поэтому ServiceAccount-субъект приходится поправить руками, иначе биндинг
+# будет ссылаться на несуществующий processing-vault в ns processing.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: processing-jobs
+  namespace: processing
+subjects:
+  - kind: ServiceAccount
+    name: processing-vault
+    namespace: workflow
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: processing-jobs
diff --git a/apps/projects/wb/kustomization.yaml b/apps/projects/wb/kustomization.yaml
new file mode 100644
index 0000000..10e9d38
--- /dev/null
+++ b/apps/projects/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: projects
+resources:
+  - ../base
diff --git a/apps/reviews/wb/kustomization.yaml b/apps/reviews/wb/kustomization.yaml
new file mode 100644
index 0000000..fe5409b
--- /dev/null
+++ b/apps/reviews/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: reviews
+resources:
+  - ../base
diff --git a/apps/rfi/wb/kustomization.yaml b/apps/rfi/wb/kustomization.yaml
new file mode 100644
index 0000000..f445a0f
--- /dev/null
+++ b/apps/rfi/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: rfi
+resources:
+  - ../base
diff --git a/apps/subscriptions/wb/kustomization.yaml b/apps/subscriptions/wb/kustomization.yaml
new file mode 100644
index 0000000..17b29cf
--- /dev/null
+++ b/apps/subscriptions/wb/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: subscriptions
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: Deployment
+      name: sarex-subscriptions
diff --git a/apps/subscriptions/wb/patch.yaml b/apps/subscriptions/wb/patch.yaml
new file mode 100644
index 0000000..0240e95
--- /dev/null
+++ b/apps/subscriptions/wb/patch.yaml
@@ -0,0 +1,22 @@
+---
+# В base MinIO-шаблон зашит на YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
+# и YC_S3_BUCKET_NAME=subscriptions — недоступно и не тот бакет для wb.
+# Реальные значения — из terraform 1.yaml (infrastructure.minio.apps.subscriptions
+# для wb): client.endpoint=http://minio-svc.minio.svc.cluster.local:9000,
+# buckets[0].name=sarex-stage-storage-new.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sarex-subscriptions
+  namespace: subscriptions
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject-template-subscriptions-minio: |-
+          {{- with secret "secrets/data/minio/apps/subscriptions" -}}
+          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+          YC_S3_BUCKET_NAME=sarex-stage-storage-new
+          YC_S3_ENDPOINT_URL=http://minio-svc.minio.svc.cluster.local:9000
+          {{- end -}}
diff --git a/apps/system-log/wb/kustomization.yaml b/apps/system-log/wb/kustomization.yaml
new file mode 100644
index 0000000..92cb30e
--- /dev/null
+++ b/apps/system-log/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: system-log
+resources:
+  - ../base
diff --git a/apps/transmittal/wb/backend.yaml b/apps/transmittal/wb/backend.yaml
new file mode 100644
index 0000000..1123230
--- /dev/null
+++ b/apps/transmittal/wb/backend.yaml
@@ -0,0 +1,259 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/transmittal/base/backend.yaml.
+#
+# TRANSMITTAL_SERVICE_APP__HOST в base смотрит на тестовый контур
+# (sarex.contour.infra.sarex.tech) — apps/transmittal/base/worker.yaml уже
+# использует правильный для wb https://lk.srx.wb.ru:30443/transmittal,
+# переносим то же значение сюда.
+# TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT в base — заглушка
+# minio.minio.svc.cluster.local:9000. Из terraform 1.yaml
+# (infrastructure.minio.apps.transmittal для wb): client.endpoint=http://10.49.10.90:9000
+# (бакет — уже динамически из vault, buckets[0].name=transmittal).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: transmittal
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: TRANSMITTAL_SERVICE_APP__NAME
+            value:
+              _default: "Transmittal Service"
+
+          - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+            value:
+              _default: "ERROR"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-svc.flows.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTAL_SERVICE_APP__HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/transmittal"
+
+          - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__PORT
+            value:
+              _default: "8000"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__ENABLE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__HOST
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
+            value:
+              _default: "backend.transmittals-prod"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__INSECURE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
+            value:
+              _default: "verify-full"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
+            value:
+              _default: "/opt/.postgresql/root.crt"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
+            value:
+              _default: "2"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
+            value:
+              _default: ""
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
+            value:
+              _default: "5672"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
+            value:
+              _default: "ru-central1"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
+            value:
+              _default: "10.49.10.90:9000"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
+            value:
+              _default: "http://marks-service.documentations.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL
+            value:
+              _default: "https://api.mailgun.net/v3/mg.sarex.io"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
+            value:
+              _default: "hello@wb.io"
diff --git a/apps/transmittal/wb/kustomization.yaml b/apps/transmittal/wb/kustomization.yaml
new file mode 100644
index 0000000..2067e6f
--- /dev/null
+++ b/apps/transmittal/wb/kustomization.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: transmittal
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: worker.yaml
+    target:
+      kind: HelmRelease
+      name: worker
diff --git a/apps/transmittal/wb/worker.yaml b/apps/transmittal/wb/worker.yaml
new file mode 100644
index 0000000..e5cd118
--- /dev/null
+++ b/apps/transmittal/wb/worker.yaml
@@ -0,0 +1,255 @@
+---
+# Патч worker для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/transmittal/base/worker.yaml.
+#
+# TRANSMITTAL_SERVICE_APP__HOST в base уже https://lk.srx.wb.ru:30443/transmittal —
+# не трогаем. Меняем только TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT — в base
+# заглушка minio.minio.svc.cluster.local:9000, реальный адрес — из terraform
+# 1.yaml (infrastructure.minio.apps.transmittal для wb): http://10.49.10.90:9000.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: worker
+  namespace: transmittal
+spec:
+  values:
+    services:
+      worker:
+        envs:
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-svc.flows.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTAL_SERVICE_APP__NAME
+            value:
+              _default: "Transmittal Service"
+
+          - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+            value:
+              _default: "ERROR"
+
+          - name: TRANSMITTAL_SERVICE_APP__HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/transmittal"
+
+          - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
+            value:
+              _default: '["*"]'
+
+          - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__PORT
+            value:
+              _default: "8000"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__ENABLE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__HOST
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
+            value:
+              _default: "backend.transmittals-prod"
+
+          - name: TRANSMITTAL_SERVICE_OTEL__INSECURE
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
+            value:
+              _default: "verify-full"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
+            value:
+              _default: "/opt/.postgresql/root.crt"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
+            value:
+              _default: "2"
+
+          - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
+            value:
+              _default: ""
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
+            value:
+              _default: "5672"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
+            value:
+              _default: "ru-central1"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
+            value:
+              _default: "true"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
+            value:
+              _default: "10.49.10.90:9000"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
+            value:
+              _default: "false"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
+            value:
+              _default: "http://marks-service.documentations.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
+            value:
+              _default: "50"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL
+            value:
+              _default: "https://api.mailgun.net/v3/mg.sarex.io"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT
+            value:
+              _default: "15"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
+            value:
+              _default: "hello@wb.io"
diff --git a/apps/workspaces/wb/kustomization.yaml b/apps/workspaces/wb/kustomization.yaml
new file mode 100644
index 0000000..f84db91
--- /dev/null
+++ b/apps/workspaces/wb/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: workspaces
+resources:
+  - ../base
diff --git a/clusters/wb/kustomization.yaml b/clusters/wb/kustomization.yaml
index a8384a3..1bd580f 100644
--- a/clusters/wb/kustomization.yaml
+++ b/clusters/wb/kustomization.yaml
@@ -4,3 +4,7 @@ resources:
   - ./flux-system
   - ./helm-repositories.yaml
   - ./infrastructure
+
+# apps
+  - ../../apps/iam/wb
+  - ../../apps/notes/wb