diff --git a/helm-chart/renku/templates/data-service/deployment.yaml b/helm-chart/renku/templates/data-service/deployment.yaml
index 75dbda719a..6ef67eed42 100644
--- a/helm-chart/renku/templates/data-service/deployment.yaml
+++ b/helm-chart/renku/templates/data-service/deployment.yaml
@@ -128,6 +128,8 @@ spec:
               value: {{ .Values.dataService.trustedProxies.proxiesCount | default "" | quote }}
             - name: REAL_IP_HEADER
               value: {{ .Values.dataService.trustedProxies.realIpHeader | default "" | quote }}
+            - name: APPS_ENABLED
+              value: {{ .Values.apps.enabled | quote }}
             - name: IMAGE_BUILDERS_ENABLED
               value: {{ .Values.dataService.imageBuilders.enabled | quote }}
             - name: BUILD_OUTPUT_IMAGE_PREFIX
diff --git a/helm-chart/renku/templates/data-service/deployment_k8s_watcher.yaml b/helm-chart/renku/templates/data-service/deployment_k8s_watcher.yaml
index 584221c0ba..3f9eee1037 100644
--- a/helm-chart/renku/templates/data-service/deployment_k8s_watcher.yaml
+++ b/helm-chart/renku/templates/data-service/deployment_k8s_watcher.yaml
@@ -54,6 +54,8 @@ spec:
               value: {{ .Values.posthog.enabled | quote }}
             - name: LOG_FORMAT_STYLE
               value: {{ .Values.logging.logFormatStyle | quote }}
+            - name: APPS_ENABLED
+              value: {{ .Values.apps.enabled | quote }}
             - name: IMAGE_BUILDERS_ENABLED
               value: {{ .Values.dataService.imageBuilders.enabled | quote }}
             - name: KUBERNETES_NAMESPACE
diff --git a/helm-chart/renku/templates/data-service/rbac.yaml b/helm-chart/renku/templates/data-service/rbac.yaml
index 3942e8e8ba..199df73d86 100644
--- a/helm-chart/renku/templates/data-service/rbac.yaml
+++ b/helm-chart/renku/templates/data-service/rbac.yaml
@@ -91,6 +91,18 @@ rules:
       - get
       - watch
   {{- end }}
+  {{- if .Values.apps.enabled }}
+  - apiGroups:
+      - serving.knative.dev
+    resources:
+      - services
+    verbs:
+      - create
+      - get
+      - list
+      - patch
+      - delete
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/helm-chart/renku/templates/data-service/rbac_k8s_watcher.yaml b/helm-chart/renku/templates/data-service/rbac_k8s_watcher.yaml
index 3684fa600d..d7c005a0b7 100644
--- a/helm-chart/renku/templates/data-service/rbac_k8s_watcher.yaml
+++ b/helm-chart/renku/templates/data-service/rbac_k8s_watcher.yaml
@@ -43,6 +43,16 @@ rules:
       - get
       - watch
   {{- end }}
+  {{- if .Values.apps.enabled }}
+  - apiGroups:
+      - serving.knative.dev
+    resources:
+      - services
+    verbs:
+      - list
+      - get
+      - watch
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
diff --git a/helm-chart/renku/values.yaml b/helm-chart/renku/values.yaml
index 29bde8a8f3..272df7b4b2 100644
--- a/helm-chart/renku/values.yaml
+++ b/helm-chart/renku/values.yaml
@@ -228,6 +228,9 @@ alerts:
     ## Client secret for the Alertmanager webhook OIDC client
     ## Will be auto-generated if not provided
     clientSecret:
+## Apps configuration
+apps:
+  enabled: false
 ## Logging configuration (applied to all services that support it)
 logging:
   ## Possible values are "json" and "plain". This defaults to "plain" if it's not set or any other value is provided.
@@ -823,8 +826,7 @@ dlf-chart:
     enabled: false
   dataset-operator-chart:
     enabled: true
-csi-rclone:
-  {}
+csi-rclone: {}
   # This section is only relevant if you are installing csi-rclone as part of Renku
   ## Name of the csi storage class to use for RClone/Cloudstorage. Should be unique per cluster.
   # storageClassName: csi-rclone
@@ -885,12 +887,12 @@ notebooks:
     ## '["https://domain-a.example.org/*", "https://domain-b.example.net/*"]'
     ## Each URI should follow the format expected by Keycloak in the Redirect
     ## URIs field of a keycloak client.
-    extraRedirectUris: '[]'
+    extraRedirectUris: "[]"
     ## This value is a yaml string of a json list of URIs strings, i.e.
     ## '["https://domain-a.example.org/*", "https://domain-b.example.net/*"]'
     ## Each URI should follow the format expected by Keycloak in the Web Origins
     ## field of a keycloak client.
-    extraWebOrigins: '[]'
+    extraWebOrigins: "[]"
   sessionIngress:
     host:
     ## If you want to use the default cluster tls cert, set the flag below to true.
@@ -1256,8 +1258,7 @@ dataService:
     ## The name of the BuildStrategy to use for image builds.
     strategyName: renku-buildpacks-v3
     ## Configuration overrides for specific target platforms
-    platformOverrides:
-      {}
+    platformOverrides: {}
       # linux/arm64:
       #   builderImage: "ghcr.io/swissdatasciencecenter/renku-frontend-buildpacks/cuda-selector:0.5.1"
       #   runImage: "ghcr.io/swissdatasciencecenter/renku-frontend-buildpacks/cuda-run-image:0.5.1"